North Korea’s Lazarus Group Launders $30M in Bitcoin via Hyperliquid

Wallets linked to North Korea’s Lazarus Group have sold more than $30 million in bitcoin on the Hyperliquid platform over the last three weeks, according to blockchain data reviewed by CoinDesk and analysis by Arkham reported by Cryptopolitan. The transactions arrive as U.S. President Donald Trump and the Commodity Futures Trading Commission push to bring the offshore derivatives exchange within American regulatory boundaries.

Blockchain analytics firms have documented massive cryptocurrency thefts tied to the Democratic People’s Republic of Korea in recent years. Chainalysis reported that the regime looted around $2 billion in cryptocurrency in 2025, marking its most prosperous year for digital asset thefts, with funds allegedly funneled into weapons programs. CertiK noted that Pyongyang has stolen roughly $6.75 billion across 263 incidents since 2016. TRM Labs reported that North Korea-affiliated hackers stole $200 million between January and August 18, accounting for over 20% of all stolen crypto during that period. Prominent incidents include the $100 million Horizon bridge heist in 2022 and a record $600 million Ronin Bridge exploit in March last year, according to the FBI and U.S. officials.

Hyperliquid Onshoring Push and Regulatory Scrutiny

The movement of funds through Hyperliquid presents a delicate regulatory challenge. President Trump stated during a White House meeting on August 19 that CFTC Chairman Michael Selig plays an important role in making Hyperliquid fully compliant and legal. Concurrently, Hyperliquid Labs has held discussions with Payward, the parent company of Kraken, regarding a U.S. strategy. Instead of purchasing a licensed exchange, the plan allows American registered traders to execute specific perpetual futures via Bitnomial, a CFTC-regulated clearinghouse operated by Payward. Payward acquired Bitnomial for $550 million on May 1, gaining access to a derivatives stack that includes a Futures Commission Merchant and Designated Contract Market.

The application remains pending with the CFTC, and the platform will still be unavailable to standard U.S. users, with Bitnomial registrants limited to a subset of perpetual futures offerings. Cryptopolitan reported that Hyperliquid faced similar scrutiny in December 2024 regarding wallets linked to North Korean parties. At that time, Hyperliquid maintained that no hacking had taken place and no user funds had vanished.

Sanctions Pressure and Exchange Dynamics

International bodies have repeatedly targeted North Korea’s revenue streams. The United Nations has imposed multiple sanctions since 2006 banning financial services, minerals, metals, and arms to restrict funding for nuclear and ballistic missile programs. TRM Labs intelligence analyst Nick Carlsen told CNBC that economic stress drives the regime toward cyberattacks. They are under pretty serious economic stress with international sanctions. They need every dollar they can. And this is just obviously a much more efficient way for North Korea to make money, Carlsen said. Carlsen added that even funds not spent directly on weapons components free up capital for state programs. Cryptopolitan noted that a Royal United Services Institute report published on August 11 called for stricter onboarding processes and information-sharing rules among virtual asset service providers to counter these conversions of looted crypto into fiat currency. The protocol allocates 99% of trading fees to an Assistance Fund that automatically converts fees into HYPE and burns them, permanently removing tokens from supply. An SEC filing by Hyperliquid Strategies showed 46.7 million HYPE tokens—representing 4.7% of the initial supply—had been removed as of August 23.