Wallets connected to the Office of Foreign Assets Control (OFAC)- sanctioned Lazarus Group have moved more than $30 million through the decentralized derivatives exchange Hyperliquid over the past three weeks, according to on-chain data published by Arkham researcher Emmett Gallic.
The transfers, tracked through August 31, 2026, were routed via HyperUnit and converted from Bitcoin into Ethereum and Solana before being bridged to several networks and delivered to a mix of centralized exchanges and unlabeled Tron-based services. The findings arrive at a politically sensitive juncture for the Singapore-based platform, which is separately in advanced discussions over a United States-regulated entry.
What Arkham’s on-chain data shows
Gallic disclosed the wallet activity on X on August 31, 2026, stating that “addresses linked to OFAC Sanctioned Lazarus Group (North Korea) have been actively moving $30M+ through Hyperliquid (HyperUnit) as recent as yesterday.”
The accompanying Arkham transaction dashboard listed four outflows attributed to “Lazarus Group: Hack” between July 30 and August 28, 2026, involving 244.148 BTC valued at $19.42 million, 262.2 BTC valued at $16.63 million, 136.344 BTC valued at $8.83 million, and 121.502 BTC valued at $7.74 million.
According to the on-chain trace, proceeds from the Bitcoin sales were used to acquire Ether (ETH) and Solana (SOL), which were subsequently bridged to Tron, Solana, and Ethereum, and finally sent to centralized exchanges including KuCoin, LBank, and Kraken, together with several unlabeled Tron-based services. Splitting proceeds across multiple venues is a well-documented pattern used to obscure the ultimate destination of illicit funds.
The wallets Arkham labelled as Lazarus-linked were first surfaced by on-chain investigator ZachXBT in 2024. On May 21, 2024, ZachXBT disclosed seven addresses on X holding 891.13 BTC, worth approximately $61.8 million at the time, tied to the state-sponsored hacking group. That disclosure followed his April 29, 2024 investigation into how Lazarus laundered more than $200 million from 25 exploits between August 2020 and October 2023, which resulted in $3.8 million in digital assets being frozen by authorities.
The Crypto Times has extensively covered ZachXBT’s investigations, including the Chinese OTC trader Yicong Wang accused of helping Lazarus cash out stolen crypto, and the DPRK crypto network analyzed from leaked server data.
Understanding HyperUnit and the routing pattern
HyperUnit, often referred to as Unit, is the asset tokenization layer used by Hyperliquid that lets holders lock native Bitcoin, Ethereum, and Solana on their origin chains and mint one-to-one tokenized versions (uBTC, uETH, uSOL) inside Hyperliquid’s HyperCore and HyperEVM environments.
A decentralized guardian network operates the lock-and-mint bridge, which allows real BTC to move onto Hyperliquid without touching a wrapped-token issuer or a centralized exchange. That same design also means that a sanctioned entity can, in principle, deposit native BTC and immediately gain access to Hyperliquid’s spot and perpetual markets.
The US sanctions angle
The presence of Lazarus-linked assets on Hyperliquid carries a direct compliance angle because the United States Treasury has designated the group and identified it as a cyber organization controlled by the North Korean government. The initial Treasury designation of Lazarus Group, Bluenoroff, and Andariel dates to September 2019, and OFAC has since expanded the list of sanctioned wallets and off-ramps tied to the cluster. Blockchain analytics firm Chainalysis has reported that value received by sanctioned entities surged 694% in 2025, underscoring the pace at which state-backed activity has scaled.
Using a decentralized venue complicates enforcement because Hyperliquid allows users to connect a wallet and trade without opening a brokerage account, though the protocol’s public ledger still records every transfer, enabling firms such as Arkham to trace movements between labeled addresses. This is not the first time Hyperliquid has been tied to North Korean addresses.
In December 2024, the platform experienced its largest recorded net outflows after MetaMask security researcher Taylor Monahan warned that suspected DPRK-controlled wallets had been probing the venue, triggering more than $250 million in withdrawals, as previously reported by The Crypto Times.
Trump’s onshoring push and the Payward-Bitnomial structure
The disclosure lands during an active phase of US regulatory engagement with Hyperliquid. At a White House meeting on August 19, 2026, President Donald Trump said Commodity Futures Trading Commission (CFTC) Chairman Michael Selig was working to bring Hyperliquid into the United States “in a fully compliant and legal fashion.”
The comment, delivered alongside SEC Chair Paul Atkins and executives from Coinbase, Ripple, Robinhood, Kraken, Nasdaq and Intercontinental Exchange, sent HYPE, the platform’s native token, up sharply on the day, with related equities also rallying.
Days later, Bloomberg reported on August 31, 2026, that Hyperliquid Labs and Payward, the parent company of Kraken, are in advanced discussions on a structure that would allow US registered users to trade a subset of Hyperliquid-linked perpetual futures through Bitnomial, a CFTC-regulated derivatives exchange and clearinghouse owned by Payward.
People familiar with the talks said Payward has already presented the CFTC with an outline of the proposed arrangement, though regulatory approval remains outstanding and the financial terms have not been disclosed. Payward completed its acquisition of Bitnomial earlier in 2026 in a deal valued at up to $550 million. The Crypto Times has separately detailed the Kraken-Payward-Bitnomial route into US markets and the accompanying HYPE price reaction.
Under the proposed setup, eligible American traders would trade contracts on Bitnomial rather than connect directly to Hyperliquid’s permissionless interface, which continues to geoblock US residents. Bitnomial would handle the venue, customer onboarding, and compliance requirements, while Hyperliquid technology would support the underlying markets tied to the listed contracts.
Broader context
Hyperliquid remains the dominant venue in the decentralized perpetual futures segment, with more than $4 billion in daily trading volume and roughly $5.19 trillion in cumulative perpetual volume, according to DeFiLlama.
HYPE was trading near $81 on August 29 following an all-time high above $86 recorded on August 27, 2026, as covered in The Crypto Times’ HYPE price analysis.
The Lazarus Group, tracked by threat intelligence firms under aliases including APT38 and TraderTraitor, is a unit of North Korea’s Reconnaissance General Bureau and has been linked to some of the largest thefts in crypto history, including the $1.5 billion Bybit exploit in February 2025 and the April 2026 KelpDAO breach. The Crypto Times has documented the cluster’s operations in its report on the $7.3 billion heist empire tied to the group.
Neither Hyperliquid Labs nor Payward have publicly commented on the Arkham findings; LBank and Kraken did not provide confirmation of whether the transferred assets were credited to any active customer account.
Kraken said in a statement that it maintains a compliance program with blockchain analytics partners designed to identify and block sanctioned wallet assets before they enter its platform, adding that risk-control actions at the account level may not always be visible from public blockchain data alone.
Also Read: Bitcoin Wallet Moves 10 BTC After More Than 15 Years of Dormancy
