North Korean hackers are moving tens of millions on Hyperliquid as Trump pushes to onshore the crypto platform
Blockchain data indicates that North Korean hackers from the Lazarus Group are using the Hyperliquid platform to launder tens of millions in cryptocurrency. Major exchanges are facing scrutiny over their compliance measures regarding these sanctioned funds.
Why it matters
The incident underscores the ongoing challenges of regulatory compliance and security in decentralized finance and the vulnerability of crypto platforms to state-sponsored cybercrime.
North Korean hackers are moving funds through Hyperliquid, selling more than $30 million in bitcoin BTC $ 78,854.07 on the decentralized derivatives trading platform in the past three weeks alone, according to blockchain data.
The data, which was reviewed exclusively by blockchain analytics firm Arkham at CoinDesk's request, identified wallets linked to North Korea’s state-sponsored hacking squad, the Lazarus Group, actively moving funds through the platform. Proceeds from the hackers’ recent bitcoin sales were used to acquire ether ETH $ 2,471.71 and solana (SOL), which were subsequently transferred to other crypto exchanges, including Kraken, LBank and KuCoin.
The wallets that Arkham identified as being linked to Lazarus were first discovered by crypto sleuth ZachXBT in 2024 .
CoinDesk has not yet established the identities of the owners of the accounts receiving funds at the centralized exchanges, or whether the platforms were aware of the funds’ origins.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in