Report says Lazarus Group launders $30M BTC

TLDR

North Korea-linked Lazarus Group is reported to have laundered over $30 million in Bitcoin using the Hyperliquid derivatives exchange.

1. Blockchain analytics firms say Lazarus-linked wallets sold over $30 million in BTC via Hyperliquid, then routed proceeds through other coins and centralized exchanges.
2. The incident highlights how deep, KYC free DeFi liquidity can be used by sanctioned actors, just as Hyperliquid pursues a regulated entry into the United States.
3. Expect closer regulatory scrutiny of DeFi derivatives, stricter screening of flows from Hyperliquid and similar platforms, and potential conditions on US access to this liquidity.

Deep Dive

1. How The $30M Laundering Allegedly Worked

According to on-chain analysis cited by Arkham and CoinDesk, Lazarus Group-linked addresses sold over $30 million in Bitcoin over roughly three weeks using the Hyperliquid protocol, a high volume perpetuals platform. One report states that these addresses converted BTC proceeds into ETH and SOL before sending funds on to exchanges including Kraken, LBank and others, effectively using Hyperliquid as a major hop in the laundering chain.

A separate recap notes that Lazarus "sold over $30 million in Bitcoin via Hyperliquid over three weeks" and then moved the resulting assets across multiple venues, framing this as part of North Korea's broader effort to cash out hacked crypto so it can fund the regime's programs.

Another analysis summarizing the episode says Lazarus "has laundered over $30 million in bitcoin through Hyperliquid, exploiting the platform's lack of anti-money laundering (AML) and know-your-customer (KYC) controls," and stresses that this was possible because users can trade there pseudonymously at scale.

2. Why This Is A Big Deal For DeFi And Hyperliquid

Hyperliquid is not a small niche protocol. One recent overview notes that it has processed more than $5 trillion in cumulative perpetuals volume, with about $13.3 billion in open interest and roughly $205 billion traded in the last 30 days, putting it among the largest derivatives venues globally.

At the same time, Hyperliquid is in advanced talks to enter the US market via Kraken parent Payward and Bitnomial, a CFTC regulated derivatives platform. A detailed policy piece points out that Lazarus's $30 million laundering run gives concrete ammunition to incumbents like CME that have already warned Washington that Hyperliquid's pseudonymous markets could enable sanctions evasion.

This creates a direct clash between two narratives. Supporters argue that onshoring Hyperliquid into a regulated wrapper with surveillance tools reduces risk for US users. Critics argue that if the US version is deeply interconnected with the offshore liquidity pool, sanctioned actors could still effectively transact against regulated counterparties.

3. What To Watch Next For Markets And Regulation

1. Regulatory responses and sanctions. US agencies such as the CFTC and Treasury could pressure intermediaries not to integrate directly with Hyperliquid unless they can clearly firewall US users from pseudonymous offshore flow. Additional sanctions designations are also possible if specific operators are identified.
2. Conditions on Hyperliquid's US entry. The debate over whether Bitnomial's US venue will be segregated from, or interconnected with, Hyperliquid's offshore liquidity is now more sensitive. Technical integration details will matter for how much regulatory risk US facing products carry.
3. Tougher AML controls across the industry. Centralized exchanges already rely on chain analytics to flag high risk flows. High profile cases like this, along with separate enforcement actions and new "travel rule" rules in jurisdictions such as Thailand, make it more likely that deposits coming from DeFi derivatives venues see longer holds and more documentation requests.

Conclusion

Lazarus Group allegedly moving over $30 million in BTC through Hyperliquid is less about the absolute size and more about optics. It ties one of the largest, fully on chain derivatives venues to a sanctioned state hacking program at exactly the moment that platform is seeking a regulated US foothold. For crypto users, the main implications are rising compliance friction on flows that touch pseudonymous derivatives and a higher chance that regulators push for either strict firewalls or structural limits on how DeFi liquidity can connect to regulated markets.