Wallets linked to North Korea’s Lazarus Group moved more than $30 million through Hyperliquid over the past three weeks, with activity continuing through August 31 as the onchain derivatives platform moves closer to a potential regulated U.S. entry.
More than $30 million passed through the identified wallet cluster using Hyperliquid’s HyperUnit infrastructure. The addresses had previously been connected to Lazarus by ZachXBT in 2024 through activity involving about $61 million in stolen funds.
Bitcoin Moves Into ETH and SOL Before Leaving Hyperliquid
Bitcoin entered Hyperliquid through the identified addresses before being converted into Ether and Solana. The assets were subsequently bridged across Ethereum, Solana and Tron, then moved toward deposit addresses associated with KuCoin, LBank and Kraken alongside several unlabeled Tron-based services.
The movement does not establish that the receiving exchanges knowingly handled Lazarus assets. Exchanges frequently receive deposits from externally controlled wallets, while compliance systems can freeze or investigate funds once addresses are identified as sanctioned or connected to illicit activity.
The wallet attribution is particularly significant because the Lazarus Group has been under U.S. sanctions since 2019 as an agency, instrumentality or controlled entity of North Korea’s Reconnaissance General Bureau.
Lazarus has remained one of crypto’s most prolific threat actors. Since 2017, the group has stolen more than $6 billion in cryptocurrency, including major attacks against Bybit, Ronin and other crypto infrastructure. A suspected Lazarus operation also drove the $292 million KelpDAO exploit earlier this year.
Hyperliquid Moves Toward Regulated U.S. Access
The transactions surfaced as U.S. policymakers explore ways to bring Hyperliquid-linked markets inside the regulated derivatives system.
President Donald Trump publicly named Hyperliquid during an August 19 White House crypto meeting, saying CFTC Chairman Michael Selig was working to bring the platform into the United States in a “fully compliant and legal fashion.”
Hyperliquid has already gained indirect distribution through major U.S. crypto companies outside the domestic market. Coinbase recently integrated more than 290 Hyperliquid perpetual markets into Base App for eligible users outside restricted jurisdictions.
Payward and Hyperliquid Discuss Bitnomial Structure
Hyperliquid Labs is now in advanced talks with Kraken parent Payward over a structure that could give U.S. traders access to a subset of Hyperliquid-linked perpetual futures.
The proposed route would use Bitnomial, which Payward acquired earlier this year and operates as a CFTC-licensed derivatives stack. Bitnomial holds exchange, clearing and futures-commission-merchant infrastructure required for regulated U.S. derivatives activity.
Any Hyperliquid-linked products offered through that structure remain subject to regulatory approval. The Lazarus-linked wallet cluster was still moving assets through Hyperliquid as recently as August 31.
