North Korean hackers are moving tens of millions on Hyperliquid as Trump pushes to onshore the crypto platform

North Korean hackers are moving funds through Hyperliquid, selling more than $30 million in bitcoin $BTC$78,718.34 on the decentralized derivatives trading platform in the past three weeks alone, according to blockchain data.

The data, which was reviewed exclusively by blockchain analytics firm Arkham at CoinDesk's request, identified wallets linked to North Korea’s state-sponsored hacking squad, the Lazarus Group, actively moving funds through the platform. Proceeds from the hackers’ recent bitcoin sales were used to acquire ether ETH$2,471.18 and solana (SOL), which were subsequently transferred to other crypto exchanges, including Kraken, LBank and KuCoin.

The wallets that Arkham identified as being linked to Lazarus were first discovered by crypto sleuth ZachXBT in 2024.

CoinDesk has not yet established the identities of the owners of the accounts receiving funds at the centralized exchanges, or whether the platforms were aware of the funds’ origins.

Hyperliquid did not respond to CoinDesk’s requests for comment by publication time.

A representative for Kraken told CoinDesk that “compliance is foundational to how we operate. Kraken maintains a best-in-class compliance program, including partnerships with leading blockchain analytics providers that continuously monitor onchain activity. These controls are designed to identify and block any assets associated with sanctioned wallets before they enter our platform.”

LBank said it has consistently used industry-standard compliance tools to conduct ongoing monitoring, but acknowledged that the crypto industry is "inherently cross-platform, cross-chain, and cross-jurisdictional."

"As a result," the spokesperson added, "relevant risks are often not generated by, or capable of being independently identified and addressed by, any single platform, but instead represent an ongoing challenge faced by the industry as a whole."

Meanwhile, a representative from KuCoin said they could not verify or comment on the sanctioned wallet activity without first seeing the data, which CoinDesk declined to share ahead of publication.

“We would also note that public onchain data reflects the movement of assets but does not necessarily provide a complete picture of compliance actions taken by a centralized platform after assets reach the platform. Measures such as account restrictions, regulatory reporting, or other risk-control actions may occur at the account or platform level and may not be visible from public blockchain data alone," the representative said, adding that the exchange "maintains sanctions compliance policies and procedures designed to meet applicable legal and regulatory requirements."

The Lazarus Group’s use of Hyperliquid, which could potentially put it in hot water with authorities for running afoul of U.S. sanctions laws, comes as the Trump administration has been exploring how the platform could be brought into the regulated U.S. financial system.