Lazarus-linked wallets move $30M via Hyperliquid as US entry talks advance

Lazarus Group-linked wallets moved over $30 million in Bitcoin through Hyperliquid in three weeks, Arkham data shows, as US entry talks advance.

Blockchain researcher Emmett Gallic identified the wallets as belonging to the OFAC-sanctioned North Korean hacking collective, citing ZachXBT's 2024 investigation that linked the same addresses to $61 million in stolen funds.

The wallets converted Bitcoin into Ethereum and Solana before bridging assets across Tron, Solana, and Ethereum networks. Funds reached KuCoin, LBank, Kraken, and unlabeled Tron-based services. Hyperliquid has processed $5.19 trillion in cumulative perpetual volume, with open interest at roughly $13.3 billion, DefiLlama data shows.

The fund movements coincide with President Donald Trump's Aug. 19 statement that CFTC Chair Michael Selig is working on a compliant pathway for Hyperliquid's US entry. Kraken parent Payward is in advanced talks with Hyperliquid Labs to offer selected perpetual contracts to American traders through Bitnomial, its CFTC-regulated derivatives business, pending regulatory approval.

The wallet cluster was first flagged by ZachXBT in 2024, linking the addresses to $61 million in stolen funds. Gallic reported the addresses had been actively moving funds through Hyperliquid as recently as Aug. 31, the day before his post on X.

From Hyperliquid, the converted assets moved to several centralized exchanges, including KuCoin, LBank, and Kraken, plus a number of unlabeled Tron-based services. Distributing funds across multiple platforms is a common method used to obscure the destination of illicit proceeds.

Kraken said compliance sits at the center of its operations and that it continuously monitors blockchain activity with support from analytics providers. LBank said it uses industry-standard compliance tools for continuous monitoring. KuCoin said it could not confirm the reported activity without reviewing the underlying wallet data.

Regulated US Entry Advances in Parallel

The wallet movements surfaced as Hyperliquid pursues formal access to US markets. President Donald Trump said in August that CFTC Chairman Mike Selig was working on a compliant pathway for Hyperliquid. Separately, Payward is reportedly in advanced discussions with Hyperliquid Labs over offering selected perpetual contracts to American traders through Bitnomial, its CFTC-regulated derivatives business.

Payward completed its Bitnomial purchase in May, agreeing to pay as much as $550 million in cash and stock. The acquisition gave Payward control of a designated contract market, derivatives clearing organization, and futures commission merchant. Kraken then launched regulated perpetuals for eligible US customers in June.

HYPE rose nearly 50 percent, climbing from $57 to $84, following news of the US talks, Coin Bureau reported. A "Kraken HIP-3 test DEX" was also spotted on Hyperliquid's testnet two weeks earlier, with permission controls that could support US compliance needs.

The presence of a sanctioned actor's assets on a decentralized platform does not establish that Hyperliquid assisted the activity or knew who controlled the wallets. But for US regulators, any plan to offer Hyperliquid-linked products domestically would need to address sanctions screening, customer identification, and account-level controls.

This article is for informational purposes only and does not constitute investment advice.