My analysis of on-chain data has revealed a troubling trend: wallets linked to the North Korean hacker group Lazarus, which is under U.S. sanctions, are actively using the infrastructure of the decentralized exchange Hyperliquid to move significant amounts of funds. This involves a sum exceeding $30 million, with activity recorded up to August 30.
The laundering scheme works as follows: funds in Bitcoin were sent to Hyperliquid via the HyperUnit protocol, after which they were converted into Ethereum and Solana. The assets were then moved between the Tron, Solana, and Ethereum networks, and ultimately withdrawn to the centralized exchanges KuCoin, LBank, and Kraken, as well as to a number of unidentified services on the Tron network.
These addresses were identified as belonging to the Lazarus Group back in 2024 during an investigation by the well-known on-chain detective ZachXBT. According to his data, more than $61 million in stolen funds have already passed through these wallets, confirming the systemic nature of the threat.
Hyperliquid on the threshold of the U.S. market
This activity is unfolding against the backdrop of Hyperliquid's ambitious plans to enter the regulated U.S. market. In August, President Donald Trump stated that CFTC Chairman Michael Selig is working on launching the platform in the country "in full compliance with the law," which triggered a rise of approximately 20% in the HYPE token.
Moreover, on August 31, information emerged that Hyperliquid Labs is in talks with Payward—the parent company of Kraken. The structure under discussion suggests that U.S. clients will be able to trade perpetual futures through Bitnomial, which Payward acquired in May. Bitnomial holds a full set of CFTC licenses, including exchange, broker, and clearing organization status, making it an ideal platform for launching regulated derivatives.
The deal will require regulatory approval, and representatives of both companies are refraining from comments for now. Earlier, Hyperliquid Policy Center and trade[XYZ] also proposed a mechanism to the SEC for modernizing IPOs, indicating the platform's serious intentions to integrate into the U.S. financial system.
My comment: The situation demonstrates the duality of decentralized platforms: on the one hand, they offer innovative financial instruments; on the other, they become an attractive target for malicious actors. If Hyperliquid truly enters the U.S. market, it will have to significantly strengthen its compliance and monitoring mechanisms; otherwise, regulatory risks could outweigh all the benefits of expansion.