An analysis of on-chain data has revealed that addresses linked to the North Korean hacker group Lazarus actively used the infrastructure of the decentralized exchange Hyperliquid to move funds. The amount in question exceeds $30 million, with activity recorded up until August 30. This is direct evidence that DeFi platforms continue to remain an attractive tool for laundering crypto assets, despite increased regulatory pressure.
According to my data, funds arrived at Hyperliquid via the HyperUnit service in Bitcoin, after which they were converted into Ethereum and Solana. The assets were then moved between the Tron, Solana, and Ethereum networks, and subsequently withdrawn to centralized exchanges, including KuCoin, LBank, and Kraken, as well as a number of unidentified Tron services. Such a scheme is a classic example of multi-layered movement designed to confuse traces and hinder tracking.
These wallets had previously come to the attention of on-chain detectives: in 2024, they were identified as belonging to the Lazarus Group, with more than $61 million in stolen funds passing through them. The fact that the group continues to use Hyperliquid a year later points to the insufficient effectiveness of existing mechanisms for blocking suspicious addresses at the DeFi protocol level.
Context: Hyperliquid on the threshold of the American market
The detection of this activity comes amid Hyperliquid's strategic steps to enter the regulated U.S. market. President Donald Trump publicly stated in August that CFTC Chairman Michael Selig is working on launching the platform in the country "in full compliance with the law." This statement triggered a rise in the HYPE token of approximately 20% — the market clearly responded positively to the prospect of legalization.
Moreover, information has emerged about negotiations between Hyperliquid Labs and Payward, the parent company of Kraken. The structure under discussion suggests that American clients will be able to trade perpetual futures through Bitnomial, which Payward acquired in May. Bitnomial holds a full set of CFTC licenses, making it an ideal venue for launching regulated derivatives. The deal, however, will require regulatory approval, and both parties are refraining from comments for now.
Significantly, Hyperliquid has also proposed to the SEC a mechanism for modernizing IPOs — this speaks to the platform's serious ambitions to integrate into the traditional financial system. But, as practice shows, even the most progressive DeFi protocols remain vulnerable to malicious actors, and this poses a difficult question for regulators: how to ensure security without killing innovation. In my understanding, the answer lies in strengthening transparency and implementing stricter verification procedures at the protocol level, not just at exchanges.