Wallets tied to North Korea's Lazarus Group moved more than $30 million in Bitcoin through Hyperliquid over three weeks, according to blockchain intelligence firm Arkham. The activity lands as the exchange pushes for US market access, and it raises sanctions questions the company hasn't publicly addressed.
The wallet trail
Emmett Gallic, an analyst at Arkham, identified the wallets, citing a 2024 attribution by investigator ZachXBT. The funds were converted to Ether and Solana before reaching centralized exchanges including Kraken, LBank, and KuCoin.
The conversion pattern is a familiar one. North Korea-linked actors have long used swaps to muddy the trail before cashing out through mainstream platforms.
A White House endorsement
President Trump named Hyperliquid directly at an August White House event, crediting CFTC Chairman Michael Selig with leading the effort to bring the exchange into the US in a compliant fashion. That endorsement now sits awkwardly against the wallet activity.
Kraken parent Payward is negotiating a regulated US pathway for Hyperliquid through its Bitnomial subsidiary. Payward closed its $550 million Bitnomial deal in May, gaining three CFTC-registered licenses.
The compliance question
The US Treasury's OFAC sanctioned Lazarus Group in 2019. The group has been tied to billions in stolen crypto, including the 2022 Ronin Network breach and the $1.5 billion Bybit hack in 2025. North Korea-linked actors stole roughly $1.6 billion in crypto in the first half of 2025, about 70% of global losses.
HYPE token traded at $84, reflecting a 5% gain over 24 hours, suggesting traders have not priced in sanctions risk. HYPE set a record high of $86.71 on August 27, just days before the wallet activity surfaced.
The timing isn't great for an exchange courting US regulators. Whether the CFTC or Treasury takes notice of the Arkham findings is the open question now.
