North Korea Moved $30 Million Through Hyperliquid — Just as Washington's Onshoring Plan Went Public

The two headlines landed within hours of each other, and they do not sit comfortably side by side. On Monday morning, blockchain researcher Emmett Gallic posted on X that wallets tied to North Korea’s OFAC-sanctioned Lazarus Group had been “actively moving $30M+ through Hyperliquid (HyperUnit) as recent as yesterday.” Hours later, Bloomberg reported that Hyperliquid Labs is in advanced talks with Payward — the parent company of Kraken — to bring the platform’s perpetual futures to American traders through Bitnomial, a US-regulated exchange and clearinghouse. Washington wants Hyperliquid onshore, complete with oversight and KYC. On-chain data says the platform is still moving tens of millions for the state-sponsored hacking group that stole them in the first place. Both things are true, and the collision is about to become a regulatory question.

The broader market, meanwhile, is not blinking. Bitcoin is trading near $78,700 at the start of a week that closes the books on its best month since November 2024 — up roughly 25% in August — while the US strikes on Iran that rattled stocks and lifted oil barely moved it. The market is calm. The compliance question is not.

The money trail runs straight through HyperUnit

The movement was flagged by on-chain researcher Emmett Gallic, who posted the wallet addresses on August 31 and pointed to ZachXBT’s identification of the same cluster in 2024, when it was linked to $61 million in stolen funds. Blockchain data reviewed by CoinDesk, sourced from analytics firm Arkham, corroborates the flow: more than $30 million in bitcoin moved through Hyperliquid over the past three weeks, including activity as recent as Sunday.

The pattern is textbook laundering-by-rotation. Bitcoin was funneled into Hyperliquid, converted into ether and solana, bridged across the Ethereum, Solana and Tron networks, then pushed out to centralized exchanges — KuCoin, LBank and Kraken all appear as recipients, alongside a string of unlabeled Tron-based services. Splitting proceeds across multiple venues is a standard obfuscation technique: no single exchange sees the full picture.

The December 2024 precedent matters here. Hyperliquid was already scrutinized for its association with North Korea-linked wallets back then, and the platform pushed back, insisting no breach occurred and no user funds were lost. That was true as far as it went — the wallets in question were customers, not intruders. But it established the uncomfortable reality that Hyperliquid’s permissionless design makes it a magnet for precisely the actors the US financial system is supposed to exclude. The platform does more than $4 billion in daily volume with no central operator and no gatekeeper. Anyone with an internet connection can trade.

Washington is courting the same platform

That is the core tension. Earlier this month, President Donald Trump told a White House gathering that his administration was working to bring Hyperliquid onshore, with CFTC Chairman Michael Selig said to be seeking a compliant pathway. The remarks sent the HYPE token sharply higher. Then on Monday, Bloomberg reported the concrete mechanics: Payward, which holds CFTC licensing through its Bitnomial exchange and clearinghouse, has been in advanced discussions with Hyperliquid Labs to give US traders access to a subset of the platform’s perpetual futures. Payward has reportedly already presented the CFTC with a proposal outlining the structure. Any deal still requires regulatory sign-off, and neither company would comment.

The market is pricing the possibility aggressively: HYPE climbed from around $57 to $84 — a near-50% jump — on the US entry reports, with another leg up after the Bloomberg story. The logic is straightforward. Hyperliquid is the largest offshore perps venue by volume, and the US market has been effectively closed to it since inception. A Bitnomial-backed structure would give it regulated rails, a clearinghouse and American customers.

For the regulators, the appeal is equally clear. Perpetual futures are the biggest crypto derivatives market on earth, and it happens to live offshore. Kalshi, which began offering crypto perps earlier this year, estimates offshore perpetuals trading topped $90 trillion in 2025 — up from roughly $28 trillion two years earlier. The SEC and the CFTC have been jointly asking since June where swaps and novel products like perps should sit, and which agency gets jurisdiction. A bipartisan group of former officials — including former CFTC Chair Chris Giancarlo and former Commissioner Brian Quintenz — filed a comment letter arguing that “similar risks deserve similar treatment” and warning that miscalibrated rules keep driving the business overseas. The SEC, meanwhile, has sent a rewrite of its crypto custody rules to the White House for review.

The question nobody has answered

None of this resolves the contradiction. A platform with no central operator can be given a regulated on-ramp in the US — Bitnomial can hold the license, clear the trades and run the KYC. But the permissionless core remains open to anyone, and the flows Gallic flagged did not stop while the deal was being negotiated. The CFTC, OFAC and FinCEN are being asked, in effect, to bless a structure whose unregulated twin is moving sanctioned funds in real time.

The practical stakes for US readers are real. Onshoring Hyperliquid would set a template for every other offshore venue: unregistered perps platforms, offshore exchanges, prediction markets. If the template is “regulate the access point, leave the protocol alone,” the sanctions regime gets a workaround with a government seal. If the template is full-chain compliance, Hyperliquid itself becomes the test case. And with the Senate returning September 14 and a cloture vote on the CLARITY Act scheduled for September 15 — which would hand the SEC and CFTC a statutory mandate for exactly this kind of market structure — the agencies are already drafting the rules ahead of the law.

What to watch in the coming weeks: whether the Payward deal is formally announced, whether the CFTC responds to the proposal on the table, and whether the Lazarus flows Gallic flagged keep moving through HyperUnit. The onshoring push just met its first stress test — and it involves $30 million in stolen bitcoin, a sanctioned state’s hackers, and the most-watched perps platform in crypto.

This article is for informational purposes only and does not constitute investment advice.