In less than three weeks, wallets linked to the North Korean hacker group Lazarus have moved over $30 million in Bitcoin through Hyperliquid. This activity surfaced right in the midst of negotiations over the platform's entry into the U.S. market, adding serious risk to an already complex regulatory approval process.
Arkham blockchain analyst Emmett Gallick identified these wallets, relying on attribution previously published by independent researcher ZachXBT back in 2024. Based on the transaction trail, the funds were converted into ETH and Solana (SOL), after which they were withdrawn to centralized exchanges Kraken, LBank, and KuCoin.
Political Context and Regulatory Crossroads
The situation becomes particularly acute against the backdrop of Hyperliquid's recent mention by U.S. President Donald Trump. At a White House event, he stated that CFTC Chairman Michael Selig is actively working to ensure the platform enters the U.S. market legally and in full compliance with requirements.
"I understand that Mike is also working on getting Hyperliquid to come to the U.S. in a lawful and fully compliant way, putting a lot of effort into it," Trump noted.
At the time of the analysis, the HYPE token was trading around $84, up 5% over the day. Interestingly, the price barely reacted to the news of North Korean activity — on August 27, a few days before this information emerged, the asset reached an all-time high of $86.71. This suggests that traders are not yet pricing in potential sanctions risks.
Sanctions Pressure: Precedents and Consequences
The U.S. Treasury's Office of Foreign Assets Control (OFAC) imposed sanctions on the Lazarus Group back in 2019. The group is responsible for the Ronin Network hack in 2022 and the largest theft in cryptocurrency history: the $1.5 billion heist from the Bybit exchange in 2025. By my estimates, North Korean hackers stole approximately $1.6 billion in the first half of 2025 — roughly 70% of all losses in the crypto market during that period.
This data surfaced right at the time of negotiations with Payward regarding Hyperliquid's regulated entry into the U.S. market through its subsidiary Bitnomial. In May, Payward closed the deal to acquire Bitnomial for $550 million, obtaining three CFTC licenses at once.
The question is how strictly the CFTC will interpret this story as a signal of the platform's non-compliance with requirements. The timeline for Hyperliquid's entry into the U.S. market depends precisely on this. The regulator has already approved a perpetual Bitcoin contract on one of the registered exchanges this year, and this case could serve as a benchmark when reviewing Hyperliquid's application.
My view: The market is underestimating systemic risk. Lazarus's activity through Hyperliquid is not just a one-off transaction but an indicator that the platform may not meet the AML/KYC standards the CFTC will require. If the regulator tightens its stance, the delay in entering the U.S. market could become not just a formality but a significant blow to the project's valuation and its token.