Hyperliquid’s push toward becoming part of the regulated U.S. financial system is confronting a potentially serious compliance challenge after blockchain analysis linked more than $30 million in recent activity on the decentralized trading platform to North Korea’s state-backed Lazarus hacking group.
Wallets attributed to Lazarus sold more than $30 million worth of bitcoin through Hyperliquid over approximately three weeks, according to blockchain data reviewed by analytics firm Arkham.
Rather than simply moving the bitcoin elsewhere, the wallets used proceeds from those transactions to acquire ether and solana.
Those cryptocurrencies were subsequently transferred toward centralized trading platforms including Kraken, LBank and KuCoin.
The wallet addresses involved were not newly discovered. Their suspected connection to Lazarus traces back to research published in 2024 by well-known blockchain investigator ZachXBT.
The latest activity is significant because Lazarus is not simply another criminal hacking organization.
The U.S. government considers the group part of North Korea’s state-sponsored cyber apparatus and has accused it of stealing and laundering digital assets to generate money for the government in Pyongyang, including revenue that can help support prohibited nuclear and ballistic-missile programs.
The Office of Foreign Assets Control formally sanctioned Lazarus in September 2019.
That designation generally prohibits U.S. persons from knowingly conducting transactions involving blocked property connected with the group and creates serious compliance obligations for financial companies that encounter assets tied to sanctioned actors.
The movement of Lazarus-linked funds through Hyperliquid therefore raises questions that go considerably beyond ordinary cryptocurrency market activity.
Hyperliquid operates differently from a conventional centralized exchange.
Instead of creating the type of traditional account investors might open with a stockbroker or centralized crypto company, users can connect cryptocurrency wallets directly to the protocol.
That structure allows people to trade without necessarily completing the traditional know-your-customer identity checks associated with regulated financial institutions.
It is one of the characteristics that helped decentralized finance expand so rapidly, but it also creates a difficult problem when sanctioned individuals, hackers or governments attempt to use permissionless blockchain infrastructure.
The identities behind the accounts that eventually received the Lazarus-linked assets on centralized exchanges have not been publicly established.
It is also unclear whether Kraken, LBank or KuCoin knew where the assets originated by the time they reached their systems.
Public blockchain records can show where cryptocurrency travels, but they do not necessarily reveal what happens inside a centralized exchange once the assets arrive.
A platform could potentially freeze an account, restrict withdrawals, file regulatory reports or take other compliance measures that would not appear publicly on the blockchain.
Kraken said its compliance infrastructure includes relationships with blockchain-analytics companies that continuously examine activity for connections to sanctioned cryptocurrency addresses.
The company said its controls are intended to identify and stop sanctioned assets before they successfully enter its platform.
LBank likewise said it uses standard compliance and transaction-monitoring technology.
However, it pointed to a larger challenge facing the industry: cryptocurrency can move between different blockchains, trading venues and legal jurisdictions, making illicit activity difficult for any single company to identify and stop independently.
KuCoin said it could not verify the specific transactions without reviewing the underlying blockchain information.
The company also emphasized that publicly visible cryptocurrency transfers cannot show every compliance action that may occur once funds arrive at an exchange.
Account restrictions, sanctions screening, regulatory reporting and other internal controls can happen outside the public blockchain record.
KuCoin said it maintains sanctions-compliance policies intended to satisfy applicable regulatory requirements.
Hyperliquid did not provide a response before publication of the original reporting.
The timing could hardly be more sensitive for the platform.
President Donald Trump’s administration is actively exploring a route that could allow Hyperliquid’s products to become available within the regulated U.S. market.
Trump discussed the platform publicly during a White House event on August 19.
He said Commodity Futures Trading Commission Chairman Mike Selig was working on a pathway that could bring Hyperliquid into the United States while satisfying American legal and regulatory requirements.
The announcement fits into Trump’s larger effort to make the United States a dominant center for cryptocurrency businesses and attract activity that historically took place through offshore platforms.
Hyperliquid Labs, the core development company behind the network, is based in Singapore.
Moving some of Hyperliquid’s services into the United States would require navigating an extensive regulatory framework governing derivatives.
The process would potentially involve requirements surrounding market surveillance, investor protection, exchange operations and the treatment of cryptocurrency perpetual futures.
Sanctions and anti-money-laundering controls are now likely to receive additional attention as well.
That is particularly complicated for a system in which customers can interact directly through self-controlled cryptocurrency wallets instead of entering through a conventional brokerage account.
There are already signs that Hyperliquid is working with established financial companies to solve those problems.
Payward, the parent company of Kraken, has reportedly been engaged in advanced discussions with Hyperliquid Labs about making Hyperliquid perpetual-futures products available to American traders through a regulated structure.
A proposal has reportedly been presented to the CFTC, although regulatory approval remains necessary.
The discussions highlight just how far Hyperliquid has advanced from being a relatively obscure decentralized-finance project.
It has become one of the largest cryptocurrency derivatives markets in the world.
Hyperliquid specializes heavily in perpetual futures.
Unlike ordinary futures contracts, which normally expire on a predetermined date, perpetual contracts can remain open indefinitely as long as traders maintain sufficient collateral and continue meeting the conditions associated with their positions.
The structure allows traders to speculate on rising or falling cryptocurrency and other asset prices using leverage.
Demand for those products has exploded.
Hyperliquid has processed more than $5 trillion in cumulative perpetual-futures trading volume.
Recent data placed open interest on the platform at approximately $13.3 billion, representing the value of derivatives positions that remained outstanding.
Over a recent 30-day period, approximately $205 billion in perpetual-futures contracts changed hands on Hyperliquid.
Those numbers have made the platform impossible for the traditional financial industry to ignore.
Intercontinental Exchange Chief Executive Jeffrey Sprecher publicly highlighted Hyperliquid earlier this year, describing its level of trading activity as larger than Nasdaq in the context he was discussing.
The comparison was based on trading activity rather than the corporate market value of Hyperliquid and Nasdaq.
Hyperliquid has also controlled a dominant share of decentralized perpetual-futures trading.
Its success has attracted traders interested in markets that remain available around the clock, including periods when conventional exchanges are closed.
That success has simultaneously alarmed some of the largest operators in traditional derivatives markets.
CME Group and Intercontinental Exchange have urged U.S. policymakers to scrutinize Hyperliquid and similar offshore decentralized venues.
Among their concerns are whether the structure creates opportunities for market manipulation and whether insufficient identity and sanctions controls can allow prohibited participants to trade.
CME is also engaged in a legal fight with the CFTC over the regulator’s broader effort to establish a path for cryptocurrency perpetual-futures products within the United States.
The Lazarus transactions could add weight to the sanctions side of that regulatory debate.
This is also not the first time suspected North Korean activity has caused concern around Hyperliquid.
In December 2024, security researcher Taylor Monahan, who works with MetaMask, identified cryptocurrency wallets believed to be controlled by North Korean hackers that had traded on Hyperliquid since at least October of that year.
The discovery caused considerable anxiety within the cryptocurrency community.
One concern was that the trading might not merely represent an effort to generate investment returns or launder money.
Security specialists worried that North Korean operators could be examining the platform for technical weaknesses ahead of a possible cyberattack.
Those fears triggered a rush of withdrawals.
Hyperliquid experienced roughly $250 million in net outflows within a single day as users removed assets from the protocol.
Hyperliquid said at the time that its platform had not suffered an exploit and that customer funds had not been lost.
The North Korea question has since become explicit in financial disclosures connected with Hyperliquid.
Bitwise Asset Management launched a U.S.-listed investment product tied to HYPE, the native cryptocurrency of the Hyperliquid ecosystem, in May 2026.
Regulatory filings associated with the product identify the decentralized nature of Hyperliquid as a potential sanctions and compliance risk.
The filings explain that developers and operators cannot simply force every person interacting directly with the blockchain to complete traditional know-your-customer, anti-money-laundering or sanctions checks.
No single company controls every interaction taking place across the decentralized network.
That creates a fundamental regulatory tension.
Decentralization is one of Hyperliquid’s central attractions because traders can directly control assets and interact with blockchain-based markets without depending entirely on an intermediary.
But the same architecture makes it more difficult to prevent a sanctioned organization from attempting to use the system.
The problem extends well beyond Hyperliquid.
North Korea has become one of the most aggressive government-backed participants in cryptocurrency crime.
American authorities have repeatedly accused Lazarus and related North Korean cyber organizations of conducting enormous thefts from cryptocurrency exchanges, blockchain bridges and other digital-asset infrastructure.
Treasury has said the revenue generated through those operations helps the North Korean government circumvent international sanctions and finance weapons programs.
Lazarus has been connected with some of the largest cryptocurrency thefts ever recorded.
U.S. authorities previously said the organization used Tornado Cash to obscure hundreds of millions of dollars stolen from the Ronin blockchain bridge associated with the Axie Infinity game.
The same organization was linked to laundering funds connected with attacks on Harmony’s Horizon Bridge and other cryptocurrency projects.
Treasury has responded by increasingly targeting not only individual North Korean hackers and wallet addresses but also the infrastructure used to move stolen assets.
Cryptocurrency mixers, financial facilitators and other services have been sanctioned when U.S. authorities concluded that they materially assisted Lazarus or other North Korean operations.
The scale of sanctions-related cryptocurrency activity has expanded dramatically.
Blockchain analytics firm Chainalysis estimated that the value received by sanctioned entities increased 694% during 2025.
The surge was driven increasingly by governments and government-linked actors incorporating digital assets into broader financial and national-security strategies.
Russia, Iran and North Korea were among the countries playing important roles in that shift.
Chainalysis estimated total illicit cryptocurrency transaction volume reached a record $154 billion during 2025, with state-driven sanctions evasion becoming an increasingly important contributor.
That broader environment could complicate Washington’s attempt to bring successful offshore cryptocurrency platforms into the American regulatory system.
The Trump administration has made clear that it would prefer major crypto businesses to operate under U.S. oversight rather than forcing innovation and trading activity overseas.
Hyperliquid represents one of the most important tests of that approach because of its enormous derivatives business.
Its technology demonstrates that decentralized platforms can compete directly with traditional financial exchanges on trading volume and product availability.
But becoming legally accessible to U.S. traders requires confronting obligations that an entirely permissionless global protocol was not originally designed around.
American regulators will need to determine where responsibility sits when sanctioned users access a decentralized blockchain.
That could involve distinctions between Hyperliquid Labs, validators operating the network, regulated companies providing U.S. access and the underlying protocol itself.
Kraken’s potential role could become particularly important.
A regulated intermediary could potentially provide American traders with access to Hyperliquid-linked markets while applying identity verification, sanctions screening and other compliance measures at the point where customers enter the system.
Such a structure could create a regulatory barrier between the open global protocol and U.S. users.
Whether regulators ultimately consider that sufficient remains uncertain.
The recent Lazarus activity demonstrates why the issue is no longer theoretical.
Wallets already attributed to one of the world’s most heavily sanctioned cyber organizations were apparently able to trade tens of millions of dollars worth of cryptocurrency through Hyperliquid.
The funds were converted from bitcoin into other digital assets and then sent toward centralized exchanges across multiple jurisdictions.
At the same time, the U.S. government is considering how to give American traders regulated access to the very platform those wallets used.
That collision between decentralized finance and traditional financial regulation will likely become one of the central issues facing Hyperliquid as it attempts to expand into the United States.
Its extraordinary growth has shown that traders want the products.
The next test is whether a platform built around permissionless wallet access can be connected to the American financial system while satisfying the sanctions, surveillance, investor-protection and anti-money-laundering requirements that come with it.