North Korea’s notorious hacker collective Lazarus Group has been spotted using Hyperliquid to launder crypto, according to on-chain data. Over the last three weeks, wallets tied to Lazarus dumped over $30M in BTC through the platform, swapped the proceeds into ETH and SOL, and then moved funds to Kraken, LBank, and KuCoin.

Here’s what went down

This laundering spree unfolded over the past three weeks: Lazarus-linked wallets offloaded BTC on Hyperliquid, then rotated into ETH and SOL. After the swap, they funneled the assets straight to centralized exchanges Kraken, LBank, and KuCoin. These wallets are tied to Lazarus Group, which is infamous for using complex money trails to cover their tracks.

Why Hyperliquid makes this easy

Hyperliquid lets users trade directly from their crypto wallets—no KYC checks required. That setup makes it a magnet for sanction evasion and money laundering, especially when large, liquid assets can be quickly flipped and sent to centralized exchanges for cash-out.

The political and regulatory backdrop

Donald Trump recently claimed that CFTC chief Mike Selig is working to bring Hyperliquid onshore in the US under full regulatory oversight. Earlier in 2024, wallets linked to North Korean hackers were already spotted on Hyperliquid. Back then, fears of a potential hack triggered a ≈$250M net outflow in just 24 hours.