Wallets tied to North Korea’s sanctioned Lazarus Group have been routing tens of millions of dollars through Hyperliquid, according to on-chain work first published by Arkham analyst Emmett Gallic.
The finding lands just as the Trump administration is trying to pull the same derivatives venue into the regulated US market.Gallic reported that addresses linked to the OFAC-designated group moved more than $30 million through Hyperliquid’s HyperUnit bridge as recently as August 30.
Investigator ZachXBT had already tied those same addresses in 2024 to about $61 million in stolen bitcoin.
In the latest flow, funds arrived as bitcoin, were swapped into ether and solana, then bridged out to Tron, Solana, and Ethereum.
From there they reached KuCoin, LBank, Kraken, and several unlabeled Tron services.
Gallic split the activity into two clusters: one of about $30 million that traces to wallets already labeled Lazarus, and another of about $5 million that shows similar dormancy, address style, and counterparties.
That pattern is not a claim that Hyperliquid itself was breached.
It is a claim that a permissionless venue can be used to convert and hop stolen coins before they hit centralized exchanges.
Public ledgers show the path. They do not by themselves show whether those exchanges later froze accounts, filed reports, or blocked further withdrawals.
The policy backdrop makes the tracing more than a crime-lab footnote.
At a White House gathering in mid-August, President Donald Trump said CFTC Chairman Michael Selig was working to bring Hyperliquid into the United States “in a fully compliant and legal fashion.”
Separate reporting has described advanced talks between Hyperliquid Labs and Payward, Kraken’s parent, about offering some perpetual futures to American traders through Bitnomial, a CFTC-regulated exchange and clearinghouse.
An onshore product would still have to satisfy derivatives rules, customer-protection standards, market surveillance, and sanctions screening—requirements that sit uneasily next to wallet-to-wallet trading with no traditional KYC gate.
Hyperliquid grew into the largest decentralized home for perpetual futures by letting users trade from a wallet rather than a brokerage account.
That design helped it process trillions of dollars in cumulative volume.
It also leaves developers unable to force identity checks on every address that touches the chain.
Product filings for HYPE-linked funds have already listed that gap as a sanctions risk.
Lazarus-linked wallets were flagged on the platform as early as late 2024, when earlier suspected DPRK activity helped spark a large one-day outflow even though the protocol said no user funds were taken.
US agencies have long argued that North Korean cyber units steal crypto to finance weapons programs.
Analytics firms put 2025 DPRK-linked theft near $2 billion. Converting bitcoin on a high-liquidity perps venue, then bridging into other networks before cash-out, matches a familiar layering playbook.
Addresses linked to OFAC Sanctioned Lazarus Group (North Korea) have been actively moving $30M+ through Hyperliquid (HyperUnit) as recent as yesterday.@zachxbt identified these addresses as Lazarus Group in 2024 linked to $61M in stolen fundshttps://t.co/RNJ4NMBrxA pic.twitter.com/CvivPLVnEL
— Emmett Gallic (@emmettgallic) August 31, 2026
None of that proves an intent to sabotage Hyperliquid’s US ambitions.
It does give regulators a concrete case when they ask how a permissionless global book can be walled off from a compliant American offering.
The open questions are practical.
Who controls the deposit accounts at the centralized exchanges? Which of those firms acted after the coins arrived? And can an onshore Hyperliquid product be designed so that sanctioned clusters on the open protocol do not bleed into U.S. order flow?
Until those answers are public, the $30 million trail is less a verdict on Hyperliquid than a stress test of whether DeFi can enter US markets without importing the same sanctions problem that thrives in wallet-native trading.