North Korean hackers are moving funds through Hyperliquid, selling more than $30 million in bitcoin $BTC$78,718.34 on the decentralized derivatives trading platform in the past three weeks alone, according to blockchain data.

The data, which was reviewed exclusively by blockchain analytics firm Arkham at CoinDesk's request, identified wallets linked to North Korea’s state-sponsored hacking squad, the Lazarus Group, actively moving funds through the platform. Proceeds from the hackers’ recent bitcoin sales were used to acquire ether ETH$2,471.18 and solana (SOL), which were subsequently transferred to other crypto exchanges, including Kraken, LBank and KuCoin.

The wallets that Arkham identified as being linked to Lazarus were first discovered by crypto sleuth ZachXBT in 2024.

CoinDesk has not yet established the identities of the owners of the accounts receiving funds at the centralized exchanges, or whether the platforms were aware of the funds’ origins.

Hyperliquid did not respond to CoinDesk’s requests for comment by publication time.

A representative for Kraken told CoinDesk that “compliance is foundational to how we operate. Kraken maintains a best-in-class compliance program, including partnerships with leading blockchain analytics providers that continuously monitor onchain activity. These controls are designed to identify and block any assets associated with sanctioned wallets before they enter our platform.”

LBank said it has consistently used industry-standard compliance tools to conduct ongoing monitoring, but acknowledged that the crypto industry is "inherently cross-platform, cross-chain, and cross-jurisdictional."

"As a result," the spokesperson added, "relevant risks are often not generated by, or capable of being independently identified and addressed by, any single platform, but instead represent an ongoing challenge faced by the industry as a whole."

Meanwhile, a representative from KuCoin said they could not verify or comment on the sanctioned wallet activity without first seeing the data, which CoinDesk declined to share ahead of publication.

“We would also note that public onchain data reflects the movement of assets but does not necessarily provide a complete picture of compliance actions taken by a centralized platform after assets reach the platform. Measures such as account restrictions, regulatory reporting, or other risk-control actions may occur at the account or platform level and may not be visible from public blockchain data alone," the representative said, adding that the exchange "maintains sanctions compliance policies and procedures designed to meet applicable legal and regulatory requirements."

The Lazarus Group’s use of Hyperliquid, which could potentially put it in hot water with authorities for running afoul of U.S. sanctions laws, comes as the Trump administration has been exploring how the platform could be brought into the regulated U.S. financial system.

HyperliquidNorth KoreaExclusiveCrypto TradingDerivativesLazarus groupBreaking News Related Assets Bitcoin$78,718.340.66% Ethereum$2,471.181.23% Latest Crypto News
  1. 1 OpenAI’s ‘Trust Us’ TIME cover raises an old warning for AI bulls1 hr ago
  2. 2 Bitcoin steady above $78,000, $HYPE leads as majors slip on hawkish Fed bets3 hrs ago
  3. 3 Trump Jr's firm leads $1 billion Polymarket raise at $21 billion value: Report3 hrs ago
  4. 4 CME’s share of XRP futures jumps as token rallies 40% in a week4 hrs ago
  5. 5 Kalshi lays down first lifetime ban for ex-member of Congress George Santos16 hrs ago
  6. 6 NYSE owner ICE taps tZERO for tokenized securities push, takes stake in firm17 hrs ago
  7. 7 Ireland bars crypto from new tax-advantaged investment accounts18 hrs ago
  8. 8 Bitmine makes largest ether purchase since June as Tom Lee points to crypto's strong Q318 hrs ago
  9. 9 Strategy returns to bitcoin buys, adding $370 million of $BTC last week19 hrs ago
  10. 10 Robinhood Chain beats Ethereum in daily revenue as memecoin trading takes over19 hrs ago
Latest Research

Anvil: The Missing Collateral Layer

Anvil: The Missing Collateral Layer

Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.

By CoinDesk Research Jul 29, 2026 Commissioned byAnvil

Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.

Why it matters:

Anvil is a shared on-chain collateral layer built on a programmable letter of credit: reserve assets as a guarantee -no loan, no interest, keep custody & yield.

View Full Report More From Finance

Trump Jr's firm leads $1 billion Polymarket raise at $21 billion value: Report

NYSE owner ICE taps tZERO for tokenized securities push, takes stake in firm

Ireland bars crypto from new tax-advantaged investment accounts

More From Bitcoin

OpenAI’s ‘Trust Us’ TIME cover raises an old warning for AI bulls

Bitcoin steady above $78,000, $HYPE leads as majors slip on hawkish Fed bets

Trump Jr's firm leads $1 billion Polymarket raise at $21 billion value: Report