Analysts at the Arkham platform have found that addresses linked to the North Korean hacker group Lazarus, which is under OFAC sanctions, have actively used the infrastructure of the decentralized exchange Hyperliquid to move funds. The total transaction volume exceeded $30 million, with activity recorded up to August 30.
According to my analysis of on-chain data, the laundering scheme looks as follows: funds were sent to Hyperliquid via HyperUnit in bitcoin, after which they were converted into ETH and SOL. The assets were then moved between the Tron, Solana, and Ethereum networks, and subsequently withdrawn to centralized exchanges KuCoin, LBank, and Kraken, as well as to a number of unidentified Tron services. This is a classic trail-obfuscation scheme typical of Lazarus, which allows breaking the direct link between the source and the final recipient.
These wallets were first identified by on-chain detective ZachXBT back in 2024. At that time, more than $61 million in stolen funds passed through them. The fact that the group continues to use Hyperliquid for its operations points to persistent gaps in the monitoring systems of decentralized platforms.
Hyperliquid prepares to enter the US market
The detection of this activity comes amid Hyperliquid's strategic steps to enter the regulated American market. In August, US President Donald Trump stated that Commodity Futures Trading Commission (CFTC) Chairman Michael Selig is working on launching the platform in the country "in full compliance with the law." Following this statement, the HYPE token rose by about 20%.
In addition, on August 31, information emerged about negotiations between Hyperliquid Labs and Payward, the parent company of Kraken. The structure under discussion suggests that US-registered clients will be able to trade a portion of perpetual cryptocurrency futures through Bitnomial, which already holds a full set of CFTC licenses. The deal will require regulatory approval.
Notably, Hyperliquid Policy Center and trade[XYZ] had previously proposed an IPO modernization mechanism to the SEC, indicating a systematic approach to legalization.
My expert assessment: The Lazarus situation places Hyperliquid in an ambiguous position. On the one hand, decentralized protocols cannot fully control who uses their infrastructure. On the other hand, to obtain CFTC approval and enter the American market, the platform will have to demonstrate strict measures to block sanctioned addresses. Otherwise, regulators may deem the current compliance system insufficient, which would significantly delay the licensing process.