My on-chain research has revealed a troubling trend: addresses sanctioned by the U.S. Office of Foreign Assets Control (OFAC) and linked to the North Korean Lazarus group have actively used the infrastructure of the decentralized exchange Hyperliquid to move funds. This involves an amount exceeding $30 million, with activity recorded up until August 30.
Transaction analysis shows a complex scheme: funds were sent to Hyperliquid via the HyperUnit protocol in Bitcoin, after which they were converted into ETH and SOL. The assets then migrated between the Tron, Solana, and Ethereum networks, with the final stage being the withdrawal of funds to exchanges such as KuCoin, LBank, and Kraken, as well as to a number of unidentified Tron services.
These wallets were already on the radar of the professional community. Back in 2024, renowned on-chain detective ZachXBT linked them to North Korean hacking operations, establishing that over $61 million in stolen funds had passed through them. Current activity confirms that the group continues to seek new channels for laundering crypto assets, and Hyperliquid, it seems, has become a convenient platform for them.
Hyperliquid on the threshold of the U.S. market
This news comes at an extremely sensitive time for Hyperliquid. The platform is actively preparing to enter the regulated U.S. market. In August, President Donald Trump publicly stated that CFTC Chairman Michael Selig is working on launching Hyperliquid in the country "in full compliance with the law." This statement triggered a rise of about 20% in the HYPE token.
Moreover, on August 31, information emerged that Hyperliquid Labs is in talks with Payward — the parent company of Kraken. The structure under discussion suggests that U.S. clients will be able to trade perpetual futures through Bitnomial, which Payward acquired in May. Bitnomial holds a full set of CFTC licenses, making it an ideal bridge for entering the U.S. market.
The deal will require regulatory approval, and representatives of both companies are refraining from comments for now. Earlier, Hyperliquid Policy Center and trade[XYZ] also proposed a mechanism for modernizing IPOs to the SEC.
My view: The situation is paradoxical. On one hand, Hyperliquid demonstrates impressive momentum and a drive toward institutional legitimacy. On the other, its infrastructure remains attractive to hacker groups. If the platform truly enters the U.S. market, it will have to implement stricter AML and monitoring mechanisms, otherwise regulators could put an end to all ambitious plans. The question is not whether the CFTC will notice, but how quickly they will react.