Wallets linked to North Korea's state-sponsored Lazarus Group have sold more than $30 million in bitcoin on Hyperliquid over the past three weeks, according to blockchain data reviewed by CoinDesk and analyzed by Arkham Intelligence. The activity comes as the Trump administration actively explores bringing the decentralized derivatives platform into regulated U.S. markets.

Market Context

Hyperliquid has emerged as the dominant venue for perpetual futures trading, with users connecting crypto wallets directly without traditional brokerage accounts or know-your-customer checks. The Singapore-based platform has processed more than $5 trillion in cumulative perpetual futures volume and currently holds approximately $13.3 billion in open interest, according to DefiLlama data. The exchange handled roughly $205 billion in perpetual futures volume over the past 30 days.

Analysis

The Lazarus Group wallets identified by Arkham used proceeds from bitcoin sales to acquire ether and solana, which were subsequently transferred to centralized exchanges including Kraken, LBank and KuCoin. Proceeds from the hackers' recent bitcoin sales were routed through these platforms after acquisition on Hyperliquid. The wallets in question were first discovered by independent crypto investigator ZachXBT in 2024.

This marks at least the second time North Korean-linked wallets have surfaced on the platform. In December 2024, security researcher Taylor Monahan identified suspected North Korean hacker wallets trading on Hyperliquid since October of that year, contributing to approximately $250 million in net outflows from the platform within a single day. The exchange confirmed at the time no user funds were lost and the platform was not exploited.

The timing of renewed Lazarus activity coincides with heightened regulatory attention. CME Group and ICE both urged U.S. officials earlier this year to scrutinize Hyperliquid, warning the platform could facilitate market manipulation and sanctions evasion. CME is currently suing the CFTC in an effort to block the regulator's push to clear crypto perpetual futures for U.S. trading platforms.

The Trump administration signaled its intent to bring Hyperliquid onshore at a White House event earlier this month, with Commodity Futures Trading Commission Chairman Mike Selig reportedly working on a pathway for compliant U.S. operations. Kraken's parent company Payward is separately in advanced talks with Hyperliquid Labs to bring perpetual futures to U.S. traders.

Key Numbers

- $30 million+ in bitcoin sold by Lazarus-linked wallets on Hyperliquid over three weeks

- $5 trillion in cumulative perpetual futures trading volume processed by Hyperliquid

- $13.3 billion in current open interest on the platform

- $205 billion in perpetual futures volume over the past 30 days

- 694% increase in value received by sanctioned entities in 2025, per Chainalysis data

What to Watch

Kraken parent Payward negotiations with Hyperliquid Labs remain a key development for U.S. market access. CFTC Chairman Mike Selig's stated pathway for compliant platform entry will face scrutiny given sanctions concerns raised by CME and ICE. Bitwise's HYPE ETF filing explicitly identified sanctions exposure as a risk, noting developers cannot compel wallet-based users to undergo KYC or AML screening. Treasury's expanding focus from individual sanctioned wallets to the infrastructure used to move funds could target platforms like Hyperliquid directly. The identity of accounts receiving transferred funds at centralized exchanges and whether those platforms were aware of fund origins remains unestablished.

Hyperliquid did not respond to CoinDesk requests for comment by publication time.