$30M in Bitcoin sold by Lazarus-linked wallets
Blockchain data from Arkham, as reviewed by CoinDesk, shows that wallets linked to North Korea's Lazarus Group sold more than $30 million in Bitcoin through the Hyperliquid platform over the past three weeks. The wallets converted the proceeds into Ethereum and Solana before sending the assets to centralized exchanges including Kraken, LBank, and KuCoin, according to the analysis.
Crypto investigator ZachXBT first identified the addresses in 2024, and Arkham later labeled them as connected to Lazarus. Public blockchain records show transfers between addresses but do not reveal who controls the receiving exchange accounts. CoinDesk said it could not identify the account holders or determine whether the exchanges knew about the reported source of the funds.
Exchanges respond
Kraken said compliance sits at the center of its operations and that it continuously monitors blockchain activity with support from analytics providers. According to the exchange, its controls are designed to identify and block assets connected to sanctioned wallets before they reach the platform.
LBank said it uses industry-standard compliance tools for continuous monitoring. The exchange described illicit transfers across platforms, blockchains, and jurisdictions as an industry problem that no single company can independently solve.
KuCoin said it could not confirm the reported activity without reviewing the underlying wallet data.
US regulatory talks and legal context
Bloomberg reported that Hyperliquid Labs is in advanced discussions with Payward, Kraken's parent company, over offering selected perpetual contracts to American traders through Bitnomial, Payward's CFTC-regulated exchange. Payward agreed to acquire Bitnomial in April for up to $550 million in cash and stock, completing the deal on May 1. Kraken has already listed CFTC-regulated crypto perpetuals through that infrastructure for US users.
The talks come amid broader regulatory and legal developments. President Donald Trump said he understood that CFTC Chair Michael Selig was working to bring Hyperliquid into the United States in a "fully compliant and legal fashion."
CME filed a lawsuit, Chicago Mercantile Exchange Inc. v. Selig, on June 18 in the US District Court for the District of Columbia. The court ordered the CFTC and Selig to respond by September 2, with CME's opposition to an expected motion to dismiss due October 2.
Industry warnings and market data
In May, CME and ICE told Washington that Hyperliquid's pseudonymous, always-on markets could let sanctioned state actors circumvent enforcement. ICE CEO Jeffrey Sprecher said ICE was "not freaked out about Hyperliquid" and described the two companies as helping each other understand their respective worlds.
Hyperliquid has processed approximately $19 trillion in cumulative perpetual volume, according to DefiLlama, though another DefiLlama figure cited in the same report places the cumulative trading volume at $5.19 trillion.
Lazarus Group has been sanctioned by the Treasury Department and identified as a cyber organization controlled by North Korea's government. Authorities have linked the group to the $625 million Ronin Network attack in 2022.