Lazarus Group, a North Korean cybercrime group sanctioned by the US Treasury’s Office of Foreign Assets Control (OFAC), has transferred more than $30 million through the Hyperliquid exchange’s HyperUnit service, according to blockchain researcher Emmett Gallic.
Sanctioned wallets actively use Hyperliquid
Emmett Gallic reported that wallets linked to the Lazarus Group sent Bitcoin to Hyperliquid, a decentralized exchange specializing in on-chain perpetuals, where the assets were converted into Ethereum and Solana. The converted funds were then bridged across Tron, Solana, and Ethereum networks before being distributed to various centralized exchanges and Tron-based services.
ZachXBT, a well-known blockchain investigator, previously linked this same wallet group to $61 million in stolen digital assets during 2024. These wallets had already been flagged as high risk, raising further concerns as they continue to move substantial sums across blockchain networks and through centralized venues like KuCoin, LBank, and Kraken.
Gallic shared his analysis on X, indicating that these addresses were still actively transferring funds through Hyperliquid as recently as August 31. He referenced ZachXBT’s prior identification as the foundation for attributing the wallets to Lazarus Group.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLAddresses associated with OFAC-sanctioned Lazarus Group have been observed moving over $30 million through Hyperliquid’s HyperUnit service, with linked activity as recent as August 31. Blockchain data suggests the assets have been split across several networks and centralized exchanges to obscure their path.
Transferring funds through multiple assets and across various platforms, including unmapped services on the Tron network, is a common method used by cybercrime groups to launder and mask the ultimate destination of illicit cryptocurrency.
Mini dictionary: Lazarus Group – A North Korea-linked hacking collective responsible for some of the largest crypto thefts in recent history, and currently sanctioned by US authorities.
Parallel US regulatory moves on Hyperliquid
This activity comes as Hyperliquid is pursuing regulatory approval to enter the American market. In August, US President Donald Trump stated that Commodity Futures Trading Commission (CFTC) Chairman Mike Selig is developing a compliance plan to facilitate Hyperliquid’s entry.
In a separate development, Payward, the parent company of Kraken and a prominent US-licensed crypto exchange, is reportedly in advanced talks with Hyperliquid Labs. These discussions focus on allowing US customers regulated access to a selection of Hyperliquid-linked perpetual futures contracts. The structure would be supported by Bitnomial, a regulated exchange and clearinghouse, pending full regulatory approval.
Reports from Coin Bureau indicated that HYPE—the governance token for Hyperliquid—jumped from $57 to $84, surging nearly 50% after news emerged about Hyperliquid’s US market talks. Bloomberg also reported that Payward, leveraging its CFTC registration, aims to offer on-chain perpetual futures to US traders for the first time.
| Event | Detail |
|---|---|
| Funds moved | $30 million+ |
| Past investigation | $61 million linked to Lazarus Group in 2024 |
| Token reaction (HYPE) | Rose from $57 to $84 (+47%) |
A “Kraken HIP-3 test DEX” was also recently spotted on Hyperliquid’s testnet, featuring permission controls to support US compliance. Coin Bureau reported that HYPE gained an additional 5% following Bloomberg’s coverage of the ongoing talks.
Discussions between Payward and Hyperliquid Labs are centered on giving US investors regulated access to perpetual futures, potentially making on-chain derivatives available in the country for the first time through a compliant structure.
These parallel developments put regulatory scrutiny—and industry innovation—side-by-side, as authorities assess both potential risks and opportunities associated with decentralized exchanges such as Hyperliquid.
