Blockchain data reviewed by CoinDesk shows that wallets tied to North Korea's Lazarus Group have been moving tens of millions of dollars through the decentralized trading platform Hyperliquid, with more than $30 million in bitcoin sold on the platform in the last three weeks alone, according to the outlet's reporting. The activity is unfolding at the same time that, per CoinDesk, the Trump administration has been pushing to bring the crypto platform onshore in the United States.
Hyperliquid is a decentralized exchange best known for perpetual futures trading, built on its own blockchain and associated with the HYPE token. Unlike centralized exchanges, decentralized venues generally allow users to trade directly from self-custodied wallets without submitting identity documents to a company that holds their funds. That design is a core feature for users who prioritize self-custody and privacy, but it also creates a well-documented compliance challenge: there is typically no central gatekeeper performing know-your-customer checks or freezing individual accounts, which makes it harder to block sanctioned actors from accessing liquidity.
The Lazarus Group is the name commonly used by researchers, law enforcement agencies and blockchain analytics firms to describe hacking operations attributed to North Korea. Groups linked to Pyongyang have been tied by government agencies and private investigators to a long series of intrusions targeting exchanges, bridges and individual crypto users over the past several years, and the proceeds have been repeatedly identified as a source of funding for the sanctioned state. Because of that, wallet clusters attributed to these operations are closely tracked, and their movements are often visible on public blockchains long after a theft occurs.
According to CoinDesk's account, the pattern observed on Hyperliquid involves converting holdings rather than simply parking them, with bitcoin sales making up the bulk of the flows identified over the three-week window. Public blockchain records allow analysts to follow such transfers in near real time, though attribution of a wallet to a specific group is an analytical judgment based on transaction history, clustering heuristics and prior incident data rather than a formal legal finding. Readers should treat wallet attribution as an assessment by researchers and reporters, not a confirmed determination by a court or regulator.
The reported activity lands against a broader policy backdrop in which U.S. officials have been weighing how to encourage crypto businesses to operate within American jurisdiction and under domestic oversight. Onshoring a platform generally involves subjecting it to U.S. registration, reporting and sanctions-compliance obligations, which is where questions about illicit flows become directly relevant. If a venue seeks a formal U.S. footprint, its ability to detect and restrict sanctioned counterparties is typically a central issue for regulators.
Market-wide, CoinDesk described bitcoin as holding steady above $78,000 in recent trading, with ether, solana, tron and dogecoin losing ground over 24 hours while HYPE added roughly 4% and led major tokens. Those moves reflect trading conditions at the time of the report and are not a forecast; no single news event determines future prices.
Neither Hyperliquid's response nor any regulatory action tied specifically to the reported flows was detailed in the material reviewed. This article is informational only and does not constitute financial, investment or tax advice.
This is a news summary for general information only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Always verify against the original source and do your own research before making a financial decision.
Source: CoinDesk · 2026-09-01
