North Korea’s Lazarus Sold More Than $30 Million of Bitcoin on Hyperliquid, Raising Money-Laundering Concerns

Wallets linked to the North Korean hacking group Lazarus sold more than $30 million of Bitcoin on the decentralized derivatives exchange Hyperliquid over the past three weeks.

CoinDesk reported on September 31 that on-chain analysis commissioned from blockchain analytics firm Arkham found wallets tied to Lazarus had moved funds through Hyperliquid. The addresses were first identified in 2024 by crypto investigator ZachXBT.

The analysis showed Lazarus used proceeds from the Bitcoin sales to buy Ether and Solana. Those assets were later moved to centralized exchanges including Kraken, LBank and KuCoin. CoinDesk said it could not verify the actual owners of the accounts that received the funds at those exchanges, or whether the platforms were aware of the source of the assets.

Kraken said it works with blockchain analytics firms to block inflows of assets linked to sanctioned wallets. LBank said it continuously monitors transactions using compliance tools that meet industry standards. KuCoin said it could not determine whether sanctioned wallets were involved without directly reviewing the relevant data.

The transactions surfaced as the US government considers how to bring Hyperliquid into the regulated financial system. Earlier this month, President Donald Trump said Commodity Futures Trading Commission member Mike Selig was preparing a framework that would allow Hyperliquid to operate legally and in compliance with regulations in the US.

Hyperliquid is a decentralized platform that lets users trade perpetual futures and other products by connecting crypto wallets directly, without traditional account-opening procedures. Data from DefiLlama show cumulative perpetual futures volume on Hyperliquid has surpassed $5 trillion, while open interest stands at about $13.3 billion. Trading volume over the past 30 days totals about $205 billion.

This is not the first time wallets linked to North Korea have surfaced on Hyperliquid. In December 2024, MetaMask security researcher Taylor Monahan said wallets suspected of being controlled by North Korean hackers had been using Hyperliquid since October 2024. The activity raised the possibility of advance reconnaissance for a hack, and the platform saw net outflows of about $250 million in a single day. Hyperliquid said at the time there had been no platform breach and no loss of user funds.

The US government believes North Korea-backed hacking groups including Lazarus steal and launder crypto to generate revenue for Pyongyang. The Office of Foreign Assets Control, the US Treasury Department’s sanctions arm, designated Lazarus in 2019 and has since expanded efforts to track the crypto wallets and services it used. Chainalysis said the amount of crypto received by parties linked to sanctioned entities including North Korea, Russia and Iran surged 694% last year.