Hyperliquid is negotiating a regulated route into the U.S. through Kraken's parent, while crypto wallets attributed to North Korean hackers are reportedly moving tens of millions of dollars through the platform again.
- Hyperliquid Labs, the developer behind Hyperliquid, is in advanced talks with Payward, Kraken's parent company, to bring some of its perpetual futures to American traders, Bloomberg reported on Monday, citing people familiar with the matter.
Instead, registered customers would trade through Bitnomial, Payward's CFTC-regulated derivatives exchange and clearinghouse, with contracts linked to markets on Hyperliquid, the report reads.
- Payward has already presented the structure to the Commodity Futures Trading Commission (CFTC), though approval remains pending.
Payward agreed in April to acquire the Bitnomial crypto exchange for as much as $550 million, adding a regulated U.S. derivatives business with exchange, clearinghouse and brokerage licenses. Kraken, the crypto exchange owned by Payward, has since begun offering regulated perpetual futures to eligible U.S. customers through that infrastructure.
Hyperliquid Labs also met with the CFTC's Innovation Task Force, the regulator's unit focused on emerging financial technology, on July 15, according to the agency's meeting log.
North Korean wallets have been here before
But then, a few hours after Bloomberg broke the news, CoinDesk wrote in an X post that North Korean hackers had sold more than $30 million in BTC through Hyperliquid over the previous three weeks, citing Arkham Intelligence data reviewed by the outlet.
Proceeds from those BTC sales were used to buy ETH and SOL before being transferred to centralized exchanges like Kraken, LBank and KuCoin, according to CoinDesk.
The wallets Arkham attributed to Lazarus were originally identified by crypto sleuth ZachXBT in 2024.
A schema showing flows of DPRK-linked funds to Hyperliquid. Source: CoinDesk
- CoinDesk said it "has not yet established the identities of the owners of the accounts receiving funds at the centralized exchanges, or whether the platforms were aware of the funds' origins."
- Kraken told CoinDesk that its compliance systems continuously monitor on-chain activity and are designed to identify and block assets associated with sanctioned wallets before they enter the platform.
- LBank said it uses industry-standard compliance tools but argued that cross-chain and cross-platform activity can't always be identified or addressed by a single exchange.
- KuCoin said it couldn't verify the activity without seeing Arkham's underlying data. It also cautioned that public blockchain data doesn't necessarily show what happens after funds reach an exchange, including potential account restrictions, regulatory reporting or other compliance actions.
The report doesn't allege that Hyperliquid was breached or knowingly helped move the funds, though it marks another appearance of wallets attributed to North Korea on a platform now trying to reach regulated U.S. markets.
SCOOP: North Korean hackers are moving money through Hyperliquid, selling more than $30 million in bitcoin on the derivatives trading platform in the past three weeks, according to data from blockchain analytics firm Arkham reviewed by CoinDesk.@willcanny99 reports
— CoinDesk (@CoinDesk) August 31, 2026
The report doesn't allege that Hyperliquid was breached or knowingly helped move the funds, though it marks another appearance of wallets attributed to North Korea on a platform now trying to reach regulated U.S. markets.
- In December 2024, Taylor Monahan, a security researcher at MetaMask, the crypto wallet developed by Consensys, identified 12 addresses she attributed to North Korean cyber actors that had been active on Hyperliquid, some since at least October.
tbh if i was the dude managing Hyperliquid's 4 validators (or those fucking ghetto ass binaries on gh) I would be shitting my pants right now.
Hyperliquid dudes dont seem worried at all though so im sure its fine. 🫠 pic.twitter.com/JrrU7t1sJe— Tay 💖 (@tayvano_) December 22, 2024
- Monahan warned at the time that the trading activity could allow sophisticated attackers to become familiar with Hyperliquid's infrastructure.
Traders subsequently pulled roughly $250 million in net USDC, Circle's dollar-pegged stablecoin, from Hyperliquid in a single day as concerns spread.
Hyperliquid rejected suggestions that it had been compromised, saying on its Discord server that there had been "no DPRK exploit" and that all user funds were accounted for.
Kraken's parent has dealt with sanctions failures before
Payward also has a history with U.S. sanctions enforcement. In 2022, Kraken agreed to pay more than $360,000 to settle potential civil liability after the Treasury Department found that the exchange had processed 826 transactions worth about $1.7 million for users who appeared to be in Iran between 2015 and 2019.
OFAC, the Treasury Department's sanctions-enforcement office, said Kraken had sanctions controls in place but had failed to implement IP-address blocking for transactional activity quickly enough.
Kraken later added automated IP blocking and blockchain analytics tools and agreed to spend another $100,000 on sanctions-compliance controls. OFAC classified the apparent violations as non-egregious and said Kraken had voluntarily disclosed them.
- There's no indication that Payward or Hyperliquid violated U.S. sanctions in connection with the latest DPRK-linked activity.
- A Bitnomial arrangement would also put a regulated intermediary between American customers and Hyperliquid's markets rather than simply opening the existing platform to U.S. traders.