North Korean Hackers Move Millions on Hyperliquid Amid US Onshoring Push

Updated Aug 31, 2026, 4:52 p.m. EDT. Published Aug 31, 2026, 4:48 p.m. EDT.

5 min read

North Korea has become the single most aggressive state actor operating in the crypto space today (Getty Images/BirgitKorber) — North Korean hackers are trading on decentralized crypto exchange Hyperliquid. (Getty Images)

Resumo

Wallets connected to the Lazarus Group, North Korea’s state-backed hacking unit, have cashed out over $30 million worth of bitcoin on Hyperliquid over the past few weeks, according to Arkham blockchain records.
This activity by the hackers unfolds as the administration of U.S. President Donald Trump looks into strategies for incorporating Hyperliquid into the regulated American market.

North Korean cybercriminals are routing assets through Hyperliquid, having liquidated upwards of $30 million in bitcoin BTC on the decentralized derivatives network across the last three weeks alone, blockchain intelligence indicates.

The metrics, evaluated exclusively by blockchain research organization Arkham upon CoinDesk’s inquiry, pointed out addresses associated with the Lazarus Group—North Korea’s state-sponsored hacking collective—actively transferring capital through the protocol. Funds generated from the hackers’ recent bitcoin liquidations were utilized to purchase ether ETH and solana (SOL), which were later sent onward to alternative cryptocurrency exchanges such as Kraken, LBank, and KuCoin.

The addresses pinpointed by Arkham as tied to Lazarus were initially uncovered by blockchain investigator ZachXBT in 2024.

CoinDesk has not yet determined the identities behind the destination accounts at the centralized platforms, nor whether those exchanges were cognizant of the source of the funds.

Hyperliquid did not reply to CoinDesk’s inquiries for comment prior to publication time.

A spokesperson for Kraken shared with CoinDesk that compliance forms the bedrock of their operations. Kraken maintains a premier compliance system, featuring collaborations with top blockchain data providers that continuously audit onchain transactions. These safeguards aim to detect and freeze any funds connected to blacklisted addresses before they reach their system.

LBank reported that it continuously deploys standard compliance mechanisms for ongoing oversight, though it conceded that the digital asset sector is naturally multi-platform, cross-chain, and multi-jurisdictional.

Consequently, the representative noted, relevant risks are frequently not created by, nor capable of being independently spotted and managed by, any single entity, but instead present a persistent hurdle for the market collectively.

Meanwhile, a spokesperson for KuCoin stated they were unable to verify or comment regarding the sanctioned address activity without first reviewing the specific data, which CoinDesk withheld prior to publication.

They added that public onchain metrics display asset transfers but fail to offer a full view of compliance measures enacted by a centralized exchange after funds land there. Procedures including account freezes, regulatory filings, or other risk mitigation protocols take place internally and might not be apparent from public blockchain records alone, noting that the exchange upholds anti-money laundering and sanctions adherence policies aligned with applicable legal mandates.

The utilization of Hyperliquid by the Lazarus Group, which could potentially trigger regulatory penalties for violating American sanctions regulations, coincides with the Trump administration’s efforts to examine ways of integrating the protocol into the official U.S. financial framework.

Trump wants Hyperliquid onshore

During a White House gathering earlier in the month, Trump stated that Mike Selig, Chairman of the Commodity Futures Trading Commission (CFTC), was developing a framework to introduce Hyperliquid to the U.S. in a fully legal and compliant manner.

These remarks align with Trump’s broader objective to establish the United States as the global hub for digital assets and to entice entities previously functioning offshore to incorporate under American regulatory supervision.

Singapore-based Hyperliquid Labs serves as the primary software engineering firm behind the Hyperliquid ecosystem.

Integrating the protocol domestically will necessitate navigating regulations concerning derivatives markets, consumer safeguards, and transaction monitoring, while simultaneously tackling sanctions and financial crime exposures inherent to peer-to-peer crypto wallet trading.

Payward, the parent company of Kraken, is engaged in advanced discussions with Hyperliquid Labs to supply perpetual futures to American investors, Bloomberg reported on Monday.

Hyperliquid’s rapid rise

Hyperliquid has risen to become the leading decentralized marketplace for perpetual futures, which are derivative agreements enabling speculators to bet on asset valuations without a set expiration date.

Unlike traditional exchanges, participants link their crypto wallets directly to the network instead of establishing a standard brokerage account. The protocol also lets individuals trade straight from a wallet without registering an account or completing conventional know-your-customer checks.

Its expansion has been monumental.

Hyperliquid has handled upwards of $5 trillion in aggregate perpetual futures trading turnover and presently maintains approximately $13.3 billion in open interest, according to figures from DefiLlama. The exchange recorded roughly $205 billion in perpetual futures turnover across the preceding 30 days.

Such achievements have increasingly drawn the attention of Wall Street institutions and domestic regulators alike. Jeffrey Sprecher, CEO of Intercontinental Exchange, mentioned in May that Hyperliquid rivaled Nasdaq in transaction volume and highlighted its dominance in decentralized perpetual swaps.

Nevertheless, its architecture has likewise sparked regulatory scrutiny. Both CME Group and ICE pressed U.S. authorities to examine Hyperliquid earlier this year, warning that the network could enable market manipulation and sanctions circumvention, Bloomberg noted in May. CME Group is currently litigating against the CFTC to halt the agency’s initiative enabling crypto perpetual futures listings on domestic exchanges.

North Korean activity isn’t new

This instance marks not the first time North Korean-linked addresses have appeared on Hyperliquid.

In December 2024, Taylor Monahan, a security analyst at MetaMask, pointed out addresses suspected of belonging to North Korean hackers that had been transacting on the network since at least October of that year. That disclosure sparked worries that the activity might represent reconnaissance ahead of an impending exploit and triggered roughly $250 million in net withdrawals from Hyperliquid within a single 24-hour window. The protocol clarified at the time that no breach had occurred and client funds remained secure.

Subsequent regulatory submissions concerning prospective investment vehicles tied to the Hyperliquid native token HYPE have explicitly noted sanctions exposure as a factor.

For instance, Bitwise, the digital asset manager that rolled out an exchange-traded fund for HYPE, stated in a May regulatory filing that the developers and managers of Hyperliquid cannot force participants engaging directly with the blockchain to undergo know-your-customer, anti-money laundering, or sanctions screening, implying the network might be leveraged by blacklisted entities.

North Korea has emerged as the most prolific state-sponsored actor within the digital asset domain. The U.S. administration has charged the Lazarus Group and alternative government-backed entities with expropriating and laundering billions of dollars in crypto holdings to fund Pyongyang and its armament initiatives. OFAC blacklisted Lazarus back in 2019 and has routinely published addresses and infrastructure utilized by the collective to transfer illicit funds.

This dilemma has escalated in importance for crypto platforms as the Treasury broadens its enforcement scope from individual blacklisted wallets to the core infrastructure facilitating their transactions.

Digital asset activity connected to sanctioned nations surged in 2025, with Russia, Iran, and North Korea increasingly incorporating crypto into government-backed monetary and security operations. Capital directed to blacklisted parties surged 694% throughout the period, per Chainalysis.