Lazarus Group Sold Over $30 Million in Bitcoin on Hyperliquid, Arkham Shows

Wallets linked to North Korea’s Lazarus Group have sold more than $30 million in bitcoin on the Hyperliquid derivatives platform over the past three weeks, according to blockchain data reviewed exclusively by the analytics firm Arkham, according to a CoinDesk report published August 31, 2026. The finding places a sanctioned, state-backed hacking group at the center of the largest decentralized perpetual futures venue at the same moment the Trump administration is working to bring that platform into the regulated U.S. financial system.

The analysis identified Lazarus-linked wallets moving tens of millions on Hyperliquid and converting proceeds into ether and Solana before routing them to centralized exchanges including Kraken, LBank and KuCoin. The wallets were first flagged by the on-chain investigator ZachXBT in 2024, extending a pattern in which North Korean actors use decentralized venues to convert and move stolen digital assets.

How the Funds Moved Through Hyperliquid

Arkham’s review, conducted at CoinDesk’s request, found that proceeds from the bitcoin sales were used to acquire ether and Solana, which were subsequently transferred to the centralized exchanges. CoinDesk has not established the identities of the accounts receiving the funds at those exchanges, or whether the platforms were aware of the funds’ origins before they arrived. Hyperliquid did not respond to a request for comment by publication time. Kraken said its compliance program is designed to identify and block assets associated with sanctioned wallets before they enter the platform, while LBank pointed to its use of industry-standard monitoring tools and KuCoin noted that public on-chain data alone does not reflect the risk-control actions a centralized platform may take after assets arrive.