North Korea's notorious Lazarus Group has been funneling tens of millions of dollars through the decentralized derivatives exchange Hyperliquid, according to blockchain data reviewed by CoinDesk, even as former President Donald Trump moves to bring the crypto platform onshore in the United States.
The On-Chain Trail
Wallets linked to the state-sponsored hacking collective have offloaded more than $30 million worth of bitcoin on Hyperliquid over just the past three weeks, according to the blockchain analysis. The activity underscores how the sanctioned regime continues to lean on decentralized venues to move and liquidate stolen digital assets outside the reach of traditional financial gatekeepers.
Lazarus has long been tied to some of the largest crypto heists on record, using a rotating web of wallets and cross-chain tools to obscure the origins of pilfered funds. Decentralized platforms, which typically lack the identity checks common at centralized exchanges, have become a favored channel for cashing out.
Sanctioned hackers are quietly turning one of crypto's fastest-growing platforms into a cash-out machine.
A Political Complication
The findings arrive at a delicate moment for Hyperliquid, which has surged in popularity among traders drawn to its high-speed perpetual futures markets. The revelation that a sanctioned North Korean group is actively using the venue raises thorny compliance and national security questions.
Those concerns are amplified by Trump's push to onshore the platform, an effort aimed at anchoring more crypto infrastructure within U.S. borders and under American oversight. Bringing a venue that has been exploited by state-linked bad actors into the domestic regulatory fold could invite intense scrutiny from lawmakers and enforcement agencies.
Key tensions at play include:
- Decentralized exchanges offering fewer barriers to sanctioned entities
- Ongoing efforts to expand U.S. control over crypto trading platforms
- The persistent challenge of policing illicit flows on-chain
For now, the blockchain data serves as a reminder that even as regulators and political figures work to legitimize and domesticate crypto trading, illicit actors continue to exploit the sector's most liquid and permissionless corners.