An analysis of on-chain data has revealed a worrying pattern: wallets linked to the North Korean hacker group Lazarus have moved over $30 million in Bitcoin through Hyperliquid over the past three weeks. This activity surfaces at a critical moment as the exchange prepares for a regulated entry into the U.S. market, threatening its ambitious plans and drawing the attention of sanctions regulators.
My analysis shows that identifying these wallets was made possible by attribution carried out by the well-known independent researcher ZachXBT back in 2024. On-chain analyst Emmet Gallick from Arkham confirmed this connection. The fund movement pattern looks classic for Lazarus: first, conversion into ETH and Solana (SOL), followed by a sequential deposit into centralized exchanges — Kraken, LBank, and KuCoin. This is a typical laundering pattern they use to bypass blocks.
Trump and Hyperliquid: political context
The situation becomes particularly acute against the backdrop of recent statements by President Donald Trump. At a White House event several weeks ago, he publicly mentioned Hyperliquid, noting that the Chairman of the U.S. Commodity Futures Trading Commission (CFTC), Michael Selig, is actively working to ensure the platform enters the U.S. market legally and in full compliance with requirements. This lends political weight to the story: now any scandal around the exchange will be perceived as a reputational blow to the administration.
Notably, the market has not yet reacted to this news. The HYPE token is trading around $84, showing a 5% increase over the day. Shortly before the information about the wallets emerged, on August 27, the asset reached an all-time high of $86.71. The restrained reaction from traders suggests that they either do not see direct risks or underestimate the potential consequences for the listing.
Sanctions risk and regulatory pressure
The U.S. Treasury's Office of Foreign Assets Control (OFAC) imposed sanctions on the Lazarus Group back in 2019. The group's track record includes the Ronin Network hack in 2022 and the record $1.5 billion theft from Bybit in 2025. By my estimates, over the first half of 2025, North Korean hackers stole approximately $1.6 billion in cryptocurrency — that is roughly 70% of all market losses during that period.
This data surfaced right in the middle of negotiations by Payward (Kraken's parent company) to acquire Bitnomial for $550 million to obtain three CFTC licenses. It is through this subsidiary that Hyperliquid plans to legalize its presence in the U.S. Now the regulator has every reason to ask uncomfortable questions about how strictly the platform complies with KYC/AML requirements.
The CFTC under Selig's leadership has already approved a perpetual Bitcoin contract on one of the registered exchanges this year, which could serve as a benchmark for Hyperliquid. However, given the scale of the identified Lazarus activity, the fate of the listing now depends on how strictly the regulator views this story as a sign of non-compliance.
Expert opinion: While traders ignore this signal, I believe this is a temporary lull. If the CFTC decides to conduct a thorough review, a delay in entering the U.S. market will become inevitable. For long-term investors, this is a serious factor of uncertainty that could trigger a correction in HYPE in the medium term.