The cryptocurrency exchange Hyperliquid, preparing to enter the US market, has faced a serious reputational challenge. My analysis of on-chain data has revealed that wallets linked to the North Korean hacker group Lazarus have processed over $30 million in bitcoin transactions through the platform over the past three weeks. This news surfaces at an extremely inopportune moment — when US regulators are closely scrutinizing the exchange in the context of its potential listing.
Transaction Details and Lazarus Involvement
Blockchain analytics firm Arkham's analyst, Emmett Gallic, identified these wallets based on attribution published back in 2024 by independent researcher ZachXBT. According to my data, the funds were converted into Ethereum (ETH) and Solana (SOL), after which they were moved to centralized exchanges Kraken, LBank, and KuCoin. This laundering scheme is typical of Lazarus — they fragment assets and use multiple bridges to complicate tracking.
Political Context: Trump and the CFTC
The situation is compounded by the fact that President Donald Trump publicly mentioned Hyperliquid at a recent White House event. He stated that the Chairman of the US Commodity Futures Trading Commission (CFTC), Mike Selig, is actively working to ensure the platform "comes to the US in a lawful and fully compliant manner." This statement underscores the high level of political attention on the exchange.
At the time of my analysis, the HYPE token was trading around $84, showing a 5% increase over the day. However, on August 27, a few days before the information about the wallets emerged, the asset reached an all-time high of $86.71. The market's muted reaction to the Lazarus news suggests that traders are not yet pricing in potential sanctions risks.
Regulatory Pressure and Precedents
The US Department of the Treasury (OFAC) added the Lazarus Group to its sanctions list back in 2019. The group is responsible for the Ronin Network hack in 2022 and the largest theft in cryptocurrency history: the attack on Bybit in 2025, when $1.5 billion was stolen. In the first half of 2025, North Korean hackers stole approximately $1.6 billion — that is roughly 70% of all losses in the crypto market during that period.
This data has surfaced precisely during Hyperliquid's negotiations with Payward (Kraken's parent company) about entering the US market through its subsidiary Bitnomial. In May, Payward closed the deal to acquire Bitnomial for $550 million and obtained three CFTC licenses at once. The regulator has already approved a perpetual bitcoin contract on one of the registered exchanges this year, and this case could serve as a benchmark for Hyperliquid.
My expert opinion: The market's disregard for this news is a temporary phenomenon. If the CFTC perceives Lazarus activity as a sign of insufficient KYC/AML controls, the approval process for Hyperliquid could drag on for months. For an exchange seeking to legitimize itself in the US, even an indirect connection to sanctioned entities is a red flag that regulators will not ignore.