Author: Will Canny

Translator: Deep Tide TechFlow

Deep Tide Overview: Wallets related to the North Korean state-sponsored hacking team Lazarus Group have been actively transferring funds on the decentralized derivatives trading platform Hyperliquid, having sold over 30 million dollars' worth of Bitcoin in the past three weeks, exchanging it for Ethereum and Solana, which were then transferred to centralized exchanges such as Kraken, LBank, and KuCoin. This data was disclosed exclusively after being reviewed by blockchain analysis firm Arkham at CoinDesk's request.

In the midst of the North Korean hackers utilizing the platform, the Trump administration is exploring ways to integrate Hyperliquid into the regulated U.S. market, with reports that the CFTC chairman is leading efforts to create a "fully compliant, legal" pathway for "landing," though the activities of the Lazarus Group may cause trouble for relevant parties as they touch on U.S. sanctions.

North Korean hackers transfer tens of millions of dollars on Hyperliquid as Trump pushes for the platform's "landing"

Wallets associated with the North Korean state-sponsored hacking team Lazarus Group sold over 30 million dollars' worth of Bitcoin on Hyperliquid in recent weeks, according to data from blockchain analysis firm Arkham.

As the hackers use the platform, the Trump administration is exploring pathways to bring Hyperliquid into the regulated U.S. market.

According to blockchain data, North Korean hackers are transferring funds via Hyperliquid, having sold over 30 million dollars' worth of Bitcoin on this decentralized derivatives trading platform in just the past three weeks, quoting BTC at $78,718.34.

This data was exclusively reviewed by blockchain analysis firm Arkham at CoinDesk's request, identifying wallets related to the North Korean state-sponsored hacking team Lazarus Group that are actively transferring funds on the platform. Recent proceeds from Bitcoin sales by the hackers have been used to purchase Ethereum and Solana, which were then transferred to other cryptocurrency exchanges such as Kraken, LBank, and KuCoin.

Arkham identified these wallets related to Lazarus, which were first discovered by on-chain detective ZachXBT in 2024.

CoinDesk has not confirmed the identities of the account owners receiving funds on centralized exchanges and cannot confirm whether these platforms are aware of the source of the funds. At the time of publication, Hyperliquid had not responded to CoinDesk's request for comments.

A representative from Kraken told CoinDesk, "Compliance is the foundation of our operations. Kraken maintains a world-class compliance system, including collaboration with leading blockchain analysis providers to continuously monitor on-chain activity. These controls are designed to identify and intercept any assets related to sanctioned wallets before they enter our platform."

LBank stated that it has continuously monitored using industry-standard compliance tools but also acknowledged that the cryptocurrency industry is "inherently cross-platform, cross-chain, and cross-jurisdiction." "Therefore," the spokesperson added, "the associated risks are often not generated by any single platform and cannot be identified and addressed independently by one platform but are instead a continuous challenge faced by the entire industry."

Meanwhile, a representative from KuCoin stated that they cannot verify or comment on the activities of sanctioned wallets without seeing the data—while CoinDesk declined to share this data prior to publication. "We also want to point out that publicly available on-chain data reflects the flow of assets but does not necessarily fully represent the compliance actions taken by centralized exchanges after the assets arrive on the platform," the representative said, adding that the exchange "maintains sanction compliance policies and processes intended to meet applicable legal and regulatory requirements, including account restrictions, regulatory reporting, or other risk control measures, which may occur at the account or platform level and may not be visible solely through public blockchain data."

Image: Source: Arkham

The use of Hyperliquid by the Lazarus Group may entangle relevant parties in regulatory troubles due to its violation of U.S. sanction laws; meanwhile, the Trump administration has been exploring how to bring the platform into the regulated U.S. financial system.

Trump wants to bring Hyperliquid back to the U.S.

Earlier this month, at a White House event, Trump stated that CFTC Chairman Mike Selig is developing a pathway to bring Hyperliquid to the U.S. "in a fully compliant and legal manner."

This statement aligns with Trump's broader efforts to position the U.S. as a center for the global cryptocurrency industry and encourage businesses that have historically operated overseas to establish themselves under U.S. regulatory frameworks.

Headquartered in Singapore, Hyperliquid Labs is the core development company behind the Hyperliquid network.

Bringing this platform to the U.S. requires clarifying rules regarding derivatives exchanges, customer protection, and market monitoring, while also addressing the potential sanctions and anti-money laundering risks that may arise when users trade directly with cryptocurrency wallets.

According to a report by Bloomberg on Monday, Payward, Kraken's parent company, is in in-depth negotiations with Hyperliquid Labs to plan to bring its perpetual contract products to U.S. traders.

The Rapid Rise of Hyperliquid

Hyperliquid has become a leading venue for decentralized trading of perpetual contracts. Perpetual contracts are derivative contracts that allow traders to speculate on asset prices without an expiration date. Unlike traditional exchanges, users can connect their cryptocurrency wallets directly to the platform without needing to open traditional brokerage accounts; the platform also allows users to trade directly from wallets without needing to open accounts or undergo traditional KYC scrutiny.

Its growth has been remarkable. According to data from DefiLlama, Hyperliquid has cumulatively processed over 5 trillion dollars' worth of perpetual contract transactions, with current open positions totaling around 13.3 billion dollars. Over the past 30 days, the exchange has processed approximately 205 billion dollars in perpetual contract trading volume.

This success has increasingly drawn the attention of Wall Street and U.S. regulators. Intercontinental Exchange (ICE) CEO Jeffrey Sprecher stated in May that, based on trading activity, Hyperliquid has become "larger than Nasdaq," pointing out its dominance in the decentralized perpetual contracts space.

However, its structure has also raised regulatory questions. In a report by Bloomberg in May, both CME Group and ICE urged U.S. officials to scrutinize Hyperliquid closely, warning that the platform could foster market manipulation and sanctions evasion. CME Group is currently suing the CFTC, attempting to prevent the regulator from paving the way for the launch of cryptocurrency perpetual contracts on U.S. trading platforms.

North Korea's Activities are Not New

This is not the first time wallets related to North Korea have appeared on Hyperliquid.

In December 2024, MetaMask security researcher Taylor Monahan identified a batch of wallets suspected to be controlled by North Korean hackers, which had been trading on the platform since at least October that year. This revelation raised concerns that the activities could be reconnaissance operations before potential attacks, leading to approximately 250 million dollars in net outflows from Hyperliquid within a day. The exchange stated at the time that the platform had not been hacked and that no user funds were lost.

Recent regulatory filings regarding proposed investment products related to Hyperliquid's token HYPE clearly list sanctions risks as a factor.

For example, cryptocurrency asset management firm Bitwise, which is launching an HYPE exchange-traded fund (ETF), stated in a May filing that developers and operators of Hyperliquid cannot enforce KYC, anti-money laundering (AML), or sanction screening on users interacting directly with the blockchain, meaning that the network could potentially be exploited by sanctioned actors.

North Korea has become one of the most aggressive state actors in the cryptocurrency space. The U.S. government accuses the Lazarus Group and other state-sponsored organizations of siphoning off revenue for Pyongyang and its weapon programs, stealing and laundering billions of dollars' worth of digital assets. The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned Lazarus in 2019 and has since identified the wallets and services used by the organization to transfer stolen funds.

As the U.S. Treasury shifts its focus from individual sanctioned wallets to the infrastructure used for transferring funds, this issue is becoming increasingly important for cryptocurrency platforms.

In 2025, cryptocurrency activities associated with sanctioned nations surged, with Russia, Iran, and North Korea increasingly using digital assets for state-sponsored financial and security actions. According to data from Chainalysis, the scale of funds received by sanctioned entities surged by 694% this year.

On one hand, the Trump administration is pushing for Hyperliquid's "landing," and on the other, the active presence of the Lazarus Group on it. The compliance path for decentralized platforms is caught on this sanction red line.