Overview
- Blockchain firm Arkham and researcher Emmett Gallic report that wallets previously linked to North Korea’s OFAC‑sanctioned Lazarus Group moved or sold more than $30 million in Bitcoin through Hyperliquid over a three‑week period ending Aug. 31, 2026.
- On‑chain traces show the BTC was converted into Ethereum and Solana, bridged across networks, and routed toward centralized exchanges named in reports as Kraken, LBank and KuCoin.
- Security researcher ZachXBT first flagged the same wallet cluster in 2024 and linked it to roughly $61 million in stolen funds, strengthening the attribution used by Arkham.
- Hyperliquid’s wallet‑connected model lets users trade from self‑custody addresses without opening traditional brokerage accounts or completing KYC, which analysts say complicates account‑level sanctions screening.
- Kraken, LBank and KuCoin say they monitor blockchain activity with analytics tools but cannot confirm from public data whether incoming funds were credited to unrestricted accounts, and Payward’s advanced talks with Hyperliquid and the CFTC have intensified scrutiny of how a U.S. access plan would enforce sanctions controls.