North Korea's notorious Lazarus Group has reportedly funneled roughly $30 million in digital assets through the decentralized exchange Hyperliquid, according to on-chain analysts tracking wallets tied to the sanctioned hacking collective.
The Movement of Funds
Blockchain investigators identified transactions from addresses linked to Lazarus Group flowing through Hyperliquid, a derivatives-focused decentralized exchange that has grown rapidly in trading volume over the past year. The group, which has been sanctioned by the US Office of Foreign Assets Control, is widely blamed by governments and security firms for some of the largest crypto thefts on record.
The activity raises fresh concerns about how state-backed actors continue to route stolen or illicit funds through decentralized platforms that lack the strict identity checks common on centralized exchanges.
Sanctioned hackers are once again testing whether decentralized exchanges can serve as a highway for illicit money.
Timing Draws Scrutiny
The movement comes just weeks after regulators indicated they were exploring a pathway to bring Hyperliquid into US markets. That timing has intensified questions about compliance safeguards and the risks of onboarding a platform that appears to have been used by an OFAC-sanctioned entity.
Lazarus Group has long been associated with laundering proceeds from major exploits, and analysts say the collective frequently shifts tactics to obscure the trail of funds. Decentralized venues, which typically operate without centralized gatekeepers, present a persistent challenge for regulators and investigators.
- Lazarus Group remains under US sanctions for its role in crypto thefts
- The $30 million moved through Hyperliquid, a decentralized derivatives exchange
- The activity surfaced shortly after regulatory discussions about US market access
Ongoing Compliance Questions
The incident underscores the broader tension between the permissionless design of decentralized finance and the compliance expectations placed on platforms seeking mainstream and regulated adoption. As authorities weigh how to treat exchanges like Hyperliquid, evidence of sanctioned actors using the platform could complicate its path forward.
For now, the episode serves as a reminder that despite years of enforcement efforts, groups linked to North Korea continue to find channels to move significant sums across the crypto ecosystem.