Arkham links Lazarus to $30M+ BTC sales on Hyperliquid as U.S. onshoring talks build
Proceeds were rotated into ETH and SOL and sent to Kraken, LBank, and KuCoin as Trump touted a CFTC-led “fully compliant” pathway.
Wallets identified by Arkham as linked to North Korea’s Lazarus Group sold more than $30 million in bitcoin on Hyperliquid over the past three weeks, then rotated proceeds into ether and solana before sending funds to centralized exchanges. The flows land at an awkward moment for a wallet-to-trade perpetuals giant that the Trump administration has publicly discussed bringing into the U.S. regulatory perimeter via the Commodity Futures Trading Commission.
Key Takeaways
- Wallets identified by Arkham as linked to North Korea’s Lazarus Group sold more than $30 million in BTC on Hyperliquid over the past three weeks (relative to Aug. 31, 2026).
- The BTC-sale proceeds were used to buy ETH and SOL and then transferred onward to centralized exchanges including Kraken, LBank, and KuCoin.
- President Donald Trump said in August 2026 that Commodity Futures Trading Commission Chairman Mike Selig was working on a pathway to bring Hyperliquid into the U.S. “in a fully compliant and legal fashion.”
- DefiLlama data put Hyperliquid above $5 trillion in cumulative perpetual futures volume, about $13.3 billion in open interest, and roughly $205 billion in perps volume over the past 30 days.
Arkham Traces Lazarus BTC Selling Through Hyperliquid and Into CEXs
Arkham’s blockchain analytics tied a cluster of wallets linked to North Korea’s Lazarus Group to more than $30 million in bitcoin sales executed through Hyperliquid over the past three weeks, relative to Aug. 31, 2026. The activity is presented as trading and liquidation behavior, not a protocol exploit, and it sits squarely in the category regulators care about most: sanctioned actors using liquid market infrastructure to convert and move value.
The traced path is straightforward at the level public ledgers can support. After selling BTC on Hyperliquid, the wallets used proceeds to acquire ether (ETH) and solana (SOL), then transferred those assets to centralized exchanges including Kraken, LBank, and KuCoin.
What is not established is the part that matters for enforcement and for venue risk. The identities behind the receiving centralized-exchange accounts were not established, and it was not established whether the exchanges were aware of the funds’ origins. Hyperliquid did not respond to requests for comment by publication time, leaving unanswered what controls, if any, were applied to the wallets Arkham linked to Lazarus.
The wallets Arkham tied to Lazarus were first flagged by on-chain investigator ZachXBT in 2024, and the current tracing builds on those linkages. That matters because it frames this as a continuation of known wallet clusters rather than a brand-new attribution claim.
A Wallet-to-Trade Perps Giant Meets U.S. ‘Onshoring’ Politics
The timing is the story. Hyperliquid is not just another venue that sanctioned funds touched, it is a venue now being discussed in the same breath as U.S. derivatives oversight, and that changes how quickly a compliance incident becomes a market-structure problem.
At a White House event earlier in August 2026, Trump said Commodity Futures Trading Commission Chairman Mike Selig was working on a pathway to bring Hyperliquid into the U.S. “in a fully compliant and legal fashion.” The comment fits the administration’s broader push to pull crypto businesses that have historically operated offshore into U.S. regulatory oversight, but it also creates a near-term incentive for critics and incumbents to point at any sanctions exposure as evidence that the platform’s current model is incompatible with U.S.-style controls.
Hyperliquid’s core development company is described as Singapore-based Hyperliquid Labs. Any U.S. pathway would run through the mechanics that govern derivatives venues: rules around exchange registration, customer protections, market surveillance, and the sanctions and anti-money-laundering obligations that attach once a platform is treated as part of the regulated perimeter.
This is also landing amid heightened scrutiny from traditional market operators. Earlier in 2026, CME Group and Intercontinental Exchange urged U.S. officials to scrutinize Hyperliquid, warning it could facilitate market manipulation and sanctions evasion. CME Group is also suing the Commodity Futures Trading Commission to block the regulator’s push to pave the way for crypto perpetual futures to be offered on U.S. trading platforms, a reminder that “onshoring” is not just a compliance exercise, it is a competitive fight over who gets to list perps under what rulebook.
Why Hyperliquid’s Scale and Access Model Change the Compliance Math
Hyperliquid’s scale is what turns this from an illicit-flow anecdote into a live question about how sanctions screening works in a high-throughput derivatives market. DefiLlama data cited Hyperliquid at more than $5 trillion in cumulative perpetual futures volume, about $13.3 billion in open interest, and roughly $205 billion in perps volume over the past 30 days.
Perpetual futures are the product that concentrates leverage, liquidity, and liquidation mechanics into one venue, and open interest is the number that tells you how much risk is sitting on the table at a given moment. When a platform is carrying around $13.3 billion in open interest, counterparties and regulators tend to treat operational and compliance failures as systemic plumbing issues, not as edge-case DeFi weirdness.
The other piece is access. Hyperliquid is described as allowing users to connect crypto wallets directly and trade without opening an account or undergoing traditional know-your-customer checks. That design is part of why the venue has grown quickly, but it is also the precise friction point for any U.S. “fully compliant” narrative, because sanctions compliance in practice is often enforced at onboarding, at account controls, and at the ability to block or freeze activity tied to designated entities.
A May 2026 Bitwise filing for a proposed investment product related to Hyperliquid’s token HYPE put the issue in plain language. It flagged sanctions exposure risk and noted that developers and operators cannot compel users interacting directly with the blockchain to undergo KYC, anti-money-laundering, or sanctions screening, meaning the network could potentially be used by sanctioned actors.
That risk disclosure reads less like boilerplate when Arkham is tracing Lazarus-linked wallets actively selling BTC on the venue and routing proceeds onward. The compliance question is no longer abstract. It is about whether a wallet-based perps venue can credibly claim U.S.-grade controls without changing the user experience that made it competitive.
What Kraken, LBank, and KuCoin Said — and the Limits of On-Chain Visibility
The centralized exchanges named in the traced flow leaned on a familiar point: public blockchain data can show deposits and transfers, but it cannot show what happens inside an exchange after funds arrive.
A Kraken spokesperson said “compliance is foundational to how we operate. Kraken maintains a best-in-class compliance program, including partnerships with leading blockchain analytics providers that continuously monitor onchain activity. These controls are designed to identify and block any assets associated with sanctioned wallets before they enter our platform.”
LBank said it uses industry-standard compliance tools for ongoing monitoring, while stressing that the industry is “inherently cross-platform, cross-chain, and cross-jurisdictional,” adding that risks are often not generated by, or independently addressable by, any single platform.
KuCoin said it could not verify or comment on the sanctioned wallet activity without seeing the underlying data. It also made the on-chain limitation explicit: “We would also note that public onchain data reflects the movement of assets but does not necessarily provide a complete picture of compliance actions taken by a centralized platform after assets reach the platform. Measures such as account restrictions, regulatory reporting, or other risk-control actions may occur at the account or platform level and may not be visible from public blockchain data alone,” the representative said.
Those statements set the boundary conditions for what can be concluded from the tracing. The on-chain record supports that assets moved from Lazarus-linked wallets through Hyperliquid and then to centralized venues. It does not establish whether the receiving accounts were frozen, whether suspicious activity reports were filed, or whether the funds were ultimately converted to fiat or moved again.
The unresolved gaps are the ones that will matter if this becomes a policy fight: who controlled the receiving accounts, whether the exchanges detected the origin risk in time to block deposits, and whether Hyperliquid had any sanctions mitigations in place for wallet-based access. Hyperliquid’s non-response leaves that last question open.
The Lazarus-linked flows on Hyperliquid amid Milestones Ahead
The next milestones are procedural, not rhetorical. If the Commodity Futures Trading Commission is serious about a pathway that is “fully compliant and legal,” the market will need to see what that means in practice for a venue described as allowing trading without traditional KYC.
The first concrete signal would be follow-up statements or published guidance from the Commodity Futures Trading Commission, or from Chairman Mike Selig, that describe the required controls and the regulatory wrapper being contemplated. Without that, “onshoring” remains a political headline rather than a compliance plan.
A second signal is whether Hyperliquid or Hyperliquid Labs discloses sanctions and anti-money-laundering mitigations after declining to comment in this case. Wallet screening, geofencing, and other controls are the obvious categories, but the real question is whether any measures are enforceable at the point of trade for a wallet-to-venue model.
Third, traders should expect more tracing. Arkham or other analysts can update whether Lazarus-linked activity continues through Hyperliquid, and whether additional transfers land at centralized exchanges beyond the venues already identified.
Finally, any compliance or enforcement signals from Kraken, LBank, and KuCoin will likely be only partially visible on-chain. Account restrictions, regulatory reporting, and internal risk actions are mostly off-ledger, which means the public record may stay incomplete even if meaningful steps were taken.
My Take: The Lazarus Episode Becomes a De Facto Stress Test for Any CFTC Pathway
The flow itself is not the part people should misread. Sanctioned actors touch liquid venues all the time, and on-chain tracing often looks cleaner than the compliance reality because it stops at the deposit address. The part that changes the stakes is that this landed while the White House is publicly floating a Commodity Futures Trading Commission-led route to bring Hyperliquid inside the U.S. perimeter, which effectively invites the question regulators always ask first: where, exactly, do the controls attach when the user is just a wallet.
The threshold that matters is whether “fully compliant and legal” ends up meaning a wrapper around the existing product, or a product redesign that changes access. If the pathway is a wrapper, the stress point is sanctions screening at the moment of interaction, because the current description of Hyperliquid’s model does not rely on account opening or traditional KYC. If the pathway is a redesign, the stress point shifts to whether the venue can keep its liquidity and growth profile while adding the kinds of customer controls U.S. derivatives markets expect.
There are two plausible near-term scenarios. In the first, the Commodity Futures Trading Commission or its chair provides concrete guidance that makes clear what controls would be required, and Hyperliquid responds with specific mitigations that can be evaluated against the Lazarus episode. In the second, the guidance stays vague, Hyperliquid stays quiet, and this becomes ammunition for incumbent exchanges and market operators already urging scrutiny, especially with CME Group litigating against the regulator’s broader perps agenda.
The real test is whether the next public artifacts are procedural and specific, not promotional. A defined regulatory framework plus disclosed sanctions mitigations would turn this into a solvable compliance engineering problem, and absent that, the Lazarus-linked flows will keep functioning as the simplest argument that the onshoring story is ahead of the controls.
