Wallets associated with North Korea's Lazarus Group moved more than $30 million in Bitcoin through Hyperliquid over a three-week period, converting funds to Ether and Solana before routing them to centralized exchanges including Kraken, LBank, and KuCoin. Blockchain analyst Emmett Gallic at Arkham Intelligence identified the wallets, citing 2024 attribution work by investigator ZachXBT.
The activity introduces a potential compliance obstacle as Hyperliquid pursues approval to operate in the United States. In August, President Trump publicly named Hyperliquid at a White House event, stating that CFTC Chairman Michael Selig was working to bring the exchange into the country in a compliant manner.
Regulatory Landscape
The US Treasury's Office of Foreign Assets Control sanctioned the Lazarus Group in 2019. The group has been linked to billions of dollars in stolen cryptocurrency, including the 2022 Ronin Network breach and the $1.5 billion Bybit hack in 2025, the largest crypto theft on record. North Korea-linked actors stole approximately $1.6 billion in crypto during the first half of 2025, representing roughly 70 percent of global crypto losses in that period.
Hyperliquid's US entry strategy involves Payward, parent company of Kraken, which is pursuing a regulated pathway through its Bitnomial subsidiary. Payward closed its $550 million acquisition of Bitnomial in May, obtaining three CFTC-registered licenses.
The CFTC's treatment of the Lazarus Group wallet activity could significantly influence the pace of Hyperliquid's regulatory approval. The CFTC already cleared a Bitcoin perpetual product on a registered exchange this year, establishing a precedent for how the agency may approach the exchange's application.
