Wallets tied to North Korea's Lazarus Group have moved more than $30 million through Hyperliquid over the past three weeks, with the activity continuing as recently as August 31, even as the onchain derivatives platform moves closer to a potential regulated entry into the United States.

The funds flowed through an identified wallet cluster using Hyperliquid's HyperUnit infrastructure. On-chain investigator ZachXBT first connected these addresses to Lazarus in 2024, when they were linked to roughly $61 million in stolen funds. The timing is notable for the platform's regulatory ambitions, since U.S. sanctions compliance obligations generally require regulated entities to screen for and block transactions involving designated actors, making laundered-fund flows through a venue a factor regulators and partners typically examine.

Bitcoin Converted to ETH and SOL Before Leaving Hyperliquid

Bitcoin entered Hyperliquid through the identified addresses and was then converted into Ether and Solana. The assets were subsequently bridged across Ethereum, Solana, and Tron, and moved toward deposit addresses associated with KuCoin, LBank, and Kraken, along with several unlabeled Tron-based services. The pattern of converting between assets and crossing multiple networks is consistent with laundering techniques designed to obscure fund origins before cashing out.

The movement does not establish that the receiving exchanges knowingly handled Lazarus-linked assets. Exchanges routinely receive deposits from externally controlled wallets, and compliance systems can freeze or investigate funds once addresses are identified as sanctioned or tied to illicit activity.

The wallet attribution carries particular weight because the Lazarus Group has been under U.S. sanctions since 2019, designated as an agency, instrumentality, or controlled entity of North Korea's Reconnaissance General Bureau (U.S. Treasury).

Lazarus remains one of crypto's most prolific threat actors. Since 2017, the group has stolen more than $6 billion in cryptocurrency, including major attacks on Bybit, Ronin, and other crypto infrastructure (Arkham Intelligence). A suspected Lazarus operation was also behind the $292 million KelpDAO exploit earlier this year. U.S. officials have repeatedly identified North Korean cryptocurrency theft as a funding source for the country's weapons programs.

Hyperliquid Moves Toward Regulated U.S. Access

The transactions surfaced as U.S. policymakers explore ways to bring Hyperliquid-linked markets inside the regulated derivatives system.

President Donald Trump publicly named Hyperliquid during an August 19 White House crypto meeting, saying CFTC Chairman Michael Selig was working to bring the platform into the United States in a "fully compliant and legal fashion" (X post).

Hyperliquid has already gained indirect distribution through major U.S. crypto companies outside the domestic market. Coinbase recently integrated more than 290 Hyperliquid perpetual markets into Base App for eligible users outside restricted jurisdictions.

Payward and Hyperliquid Discuss Bitnomial Structure

Hyperliquid Labs is now in advanced talks with Kraken parent Payward over a structure that could give U.S. traders access to a subset of Hyperliquid-linked perpetual futures (Bloomberg Law).

The proposed route would use Bitnomial, which Payward acquired earlier this year and operates as a CFTC-licensed derivatives stack. Bitnomial holds the exchange, clearing, and futures-commission-merchant infrastructure required for regulated U.S. derivatives activity.

Any Hyperliquid-linked products offered through that structure remain subject to regulatory approval. The Lazarus-linked wallet cluster was still moving assets through Hyperliquid as recently as August 31, meaning the outcome of those regulatory discussions will unfold alongside ongoing scrutiny of the platform's onchain activity.