Wallets linked to North Korea's sanctioned Lazarus Group moved over $30 million through Hyperliquid, raising sanctions-compliance questions as the CFTC explores a regulated US entry for the DeFi derivatives venue.
Back
Hyperliquid faces sanctions test as Lazarus wallets route $30M
Wallets tied to North Korea's sanctioned Lazarus Group routed more than $30 million through Hyperliquid as recently as Aug. 30, testing the CFTC's plan to bring the DeFi derivatives venue into US markets.
"Addresses linked to the OFAC-designated group have been actively moving $30 million-plus through Hyperliquid as recently as yesterday," Emmett Gallic, an on-chain analyst at Arkham Intelligence, said in an Aug. 31 post on X. Gallic noted that investigator ZachXBT had identified the same addresses in 2024, linking them to about $61 million in stolen bitcoin.
The funds arrived as bitcoin, were swapped into ether and solana, then bridged out to Tron, Solana and Ethereum. From there they reached KuCoin, LBank, Kraken and several unlabeled Tron-based services. Gallic split the activity into two clusters: roughly $30 million tracing to wallets already labeled Lazarus, and another $5 million showing similar dormancy, address style and counterparties.
The disclosure lands as President Donald Trump said CFTC Chairman Michael Selig was working to bring Hyperliquid into the US "in a fully compliant and legal fashion." Payward, Kraken's parent company, is in advanced talks with Hyperliquid Labs to offer perpetual futures to American traders through Bitnomial, a CFTC-regulated exchange and clearinghouse.
Sanctions Screening Meets Wallet-Native Trading
Hyperliquid grew into the largest decentralized venue for perpetual futures by letting users trade directly from a wallet rather than a brokerage account. That design helped it process more than $5.19 trillion in cumulative volume and maintain roughly $13.3 billion in open interest. It also leaves developers unable to force identity checks on every address that touches the chain.
An onshore product through Bitnomial would still have to satisfy derivatives rules, customer-protection standards, market surveillance and sanctions screening — requirements that sit uneasily next to wallet-to-wallet trading with no traditional KYC gate. Product filings for HYPE-linked funds have already listed this gap as a sanctions risk.
Kraken said its compliance program uses blockchain analytics providers to monitor on-chain activity and identify assets associated with sanctioned wallets. LBank said it uses industry-standard compliance tools while noting that cross-chain and cross-platform activity makes illicit finance difficult for any single company to identify independently. KuCoin said it could not verify the specific activity without reviewing the underlying data, noting that account restrictions and regulatory reporting may not be visible through public blockchain records.
A $250 Million Outflow Precedent
This is not Hyperliquid's first encounter with wallets suspected of North Korean links. In December 2024, MetaMask security researcher Taylor Monahan identified suspected North Korean wallets that had been trading on the platform since at least October of that year. The disclosure contributed to roughly $250 million in net withdrawals within 24 hours, though Hyperliquid said no user funds were taken.
Lazarus Group has been under US sanctions since 2019 and is the main suspect in the $1.4 billion Bybit hack in 2025, the largest crypto theft on record. Analytics firms put 2025 DPRK-linked theft near $2 billion. Chainalysis research found that cryptocurrency transactions associated with sanctioned nations surged 694 percent throughout 2025. Converting bitcoin on a high-liquidity perps venue, then bridging into other networks before cash-out, matches a familiar layering playbook.
The open questions are practical. Who controls the deposit accounts at the centralized exchanges? Which firms acted after the coins arrived? And can an onshore Hyperliquid product be designed so that sanctioned clusters on the open protocol do not bleed into US order flow? Until those answers are public, the $30 million trail is less a verdict on Hyperliquid than a stress test of whether DeFi can enter US markets without importing the same sanctions problem that thrives in wallet-native trading.
This article is for informational purposes only and does not constitute investment advice.
