Sanctioned Hackers Move $30M As Platform Eyes US Market

Wallets tied to North Korea’s state-sponsored Lazarus Group have liquidated more than $30 million in Bitcoin on decentralized derivatives venue Hyperliquid over a three-week period. According to blockchain data analyzed by Arkham, the hackers converted the illicit proceeds into Ethereum and Solana before transferring the assets to centralized trading hubs like Kraken, LBank, and KuCoin. The addresses were initially identified by crypto investigator ZachXBT in 2024.

The on-chain activity coincides with advanced discussions to introduce the offshore platform to American retail traders. According to Bloomberg, Kraken's parent company, Payward, is negotiating with Hyperliquid Labs to provide eligible U.S. customers access to specific perpetual futures via Bitnomial, a Commodity Futures Trading Commission-regulated subsidiary that Payward acquired in May for as much as $550 million.

Sanctions and Compliance Hurdles

The presence of a heavily sanctioned cyber organization on the decentralized venue underscores the compliance challenges facing its potential U.S. expansion. The Treasury Department previously sanctioned the Lazarus Group, officially identifying it as a cyber organization controlled by the North Korean government and linking it to massive digital-asset thefts like the $625 million Ronin Network exploit in 2022.

Former Defense Secretary Mark Esper recently cited North Korean hacking groups while arguing that regulated domestic crypto markets could give U.S. law enforcement better access to customer and transaction records. Concurrently, the platform's U.S. market ambitions have gained political attention. Former President Donald Trump recently stated he understood the CFTC is actively working to bring the venue into the United States in a "fully compliant and legal fashion."

Using a decentralized platform complicates enforcement because users can connect a crypto wallet and trade without opening a traditional brokerage account. To comply with U.S. regulations, any domestic offering would require robust sanctions screening, customer identification, and account-level controls. Payward has already presented an outline of the proposed partnership to the CFTC. The perpetual futures under discussion track an underlying asset without a fixed expiration date.

Centralized Exchange Responses

While Arkham successfully traced the transfers between labeled public addresses, determining the final recipients at centralized hubs remains complex. LBank noted that cross-platform illicit transfers are an industry-wide challenge that no single company can independently detect or resolve. KuCoin cautioned that public blockchain ledgers "do not show every step taken after assets arrive at a centralized platform," including internal risk controls and account restrictions. For its part, Kraken stated its compliance protocols are actively designed to detect and block assets from sanctioned wallets before they reach the platform.

Operating a U.S. derivatives business demands strict oversight, which contrasts with the decentralized platform's current permissionless interface that specifically contractually restricts access for U.S. residents. Hyperliquid currently processes over $4 billion in daily trading volume, according to Bloomberg, meaning a compliant domestic launch could significantly impact the broader derivatives market if regulatory and anti-money laundering hurdles are successfully cleared by Payward and the CFTC.