The Three-Week Window
Washington spent the summer of 2026 negotiating how to bring onshore Hyperliquid, the crypto and derivatives venue. North Korea did not wait. According to the investigation from Arkham, the blockchain analytics firm, wallets linked to North Korea’s Lazarus Group sold more than $30 million in bitcoin on the platform over a roughly three-week window in August 2026. The proceeds were converted into ether and solana, then moved to three centralized exchanges: Kraken, LBank, and KuCoin.
The dollar figure is not the story here; the timing is. Thirty million dollars is not a large sum, neither by crypto-crime standards, nor by North Korea’s activities. What makes this episode worth an attorney’s attention is that it happened during the exact window regulators spent debating whether Hyperliquid belongs inside the U.S. regulatory perimeter or outside it.
Not the First Time
The wallets were not new to the platform. A researcher first flagged suspected North Korean activity on Hyperliquid in October 2024. Two months later, a separate identification by a researcher at MetaMask triggered roughly $250 million in outflows from the platform overnight, users pulling funds rather than share a venue with sanctioned wallets.
Lazarus is not a marginal actor experimenting with a new venue either. The FBI confirmed that Lazarus was behind the $1.5 billion theft from crypto exchange Bybit in February 2025, the largest cryptocurrency heist on record. Thirty million dollars moved through Hyperliquid is a rounding error next to that number. It is also proof that a sophisticated, well-resourced state actor has treated this specific platform as a repeatable pipeline for more than eighteen months, not a one-off convenience.
Why Hyperliquid, Specifically
Hyperliquid’s structure explains the choice of venue. The platform lets users trade perpetual futures, derivatives contracts with no expiration date, without opening an account or verifying identity (a wallet suffices). A sanctioned state actor did not need to evade know-your-customer requirements, because none applied.
As of late August 2026, the platform’s open interest stood above $13 billion, among the largest of any decentralized derivatives venue. Although figures like this move quickly and are reported inconsistently across outlets, the point that survives any given week’s number is structural, not a snapshot: scale plus zero identity verification is a combination regulators have not had to contend with before at this size.
The Regulatory Fork
Three parts of the federal government are currently pulling in three different directions on this exact fact pattern.
- In mid-August 2026, President Trump said CFTC Chairman Mike Selig was “working on a pathway to bring Hyperliquid into the U.S. in a fully compliant and legal fashion”, part of the administration’s stated goal of making the United States a hub for global crypto trading. Kraken’s parent company is reportedly in advanced talks with Hyperliquid Labs to bring the platform’s perpetual futures to U.S. traders.
- At the same time, CME Group and Intercontinental Exchange, the two largest incumbent derivatives exchanges, have spent months lobbying the CFTC and Capitol Hill to scrutinize Hyperliquid rather than welcome it. Since at least May 2026, the two exchanges have warned regulators that the platform’s anonymous, continuous trading environment could allow bad actors to manipulate prices, distort oil benchmarks, and create systemic risk, and have flagged, specifically, the possibility of “insider coordination or state-backed entities attempting to evade U.S. restrictions.” Three and a half months later, the specific risk they flagged stopped being hypothetical.
It is worth noting that perpetual futures compete directly with CME and ICE’s own futures contracts, so the two exchanges are not neutral referees here; their lobbying principally reflects a commercial stake in containing Hyperliquid, not only a policy concern.
- A third federal actor cuts against enforcement altogether. In April 2025, Deputy Attorney General Todd Blanche issued a memo titled “Ending Regulation by Prosecution,” disbanding the Justice Department’s National Cryptocurrency Enforcement Team and instructing prosecutors to stop bringing unlicensed money-transmission, Bank Secrecy Act, or unregistered-securities charges against exchanges, mixers, or wallet providers unless the violation was willful. The memo preserves prosecutions tied to terrorism, trafficking, hacking, and direct investor fraud, so a Lazarus-linked case is not automatically off the table, but it materially narrows the path DOJ would take to reach the underlying conduct described here.
One footnote worth knowing: ProPublica has reported that Blanche personally held between $159,000 and $485,000 in bitcoin, solana, cardano, and ethereum at the time of his March 2025 confirmation, and had agreed not to participate in any matter affecting those holdings until they were sold, with a divestment deadline ninety days after confirmation. Rather than selling, he gifted the bulk of the holdings, valued between $116,000 and $315,000, to his adult children and a grandchild in late May and early June 2025, inside that window, and separately sold another $5,000 to $75,000 in crypto-related investments. Ethics experts told ProPublica that gifting the assets to family, while technically permitted, undercuts the purpose of the conflict-of-interest rule nearly as much as continuing to hold them would have. That is a reported fact about one official’s personal financial conflict, not a claim about the administration’s broader policy, but it bears on how durable the current non-enforcement posture should be assumed to be.
None of this is necessarily a contradiction. An agency negotiating a pathway to bring a platform onshore, a rival exchange lobbying to constrain it, and a Justice Department declining to prosecute unrelated past conduct are three institutions doing three different jobs, not proof the government has taken inconsistent positions on the same question. What is actually worth watching is narrower: whether any CFTC pathway that materializes addresses the identity-verification gap this episode exposed, or leaves it in place.
The Precedent That Actually Applies
The closest existing case law to a Hyperliquid-adjacent liability theory is not about Hyperliquid at all. In August 2025, a Southern District of New York jury convicted the crypto mixer Tornado Cash and its co-founder Roman Storm of conspiracy to operate an unlicensed money transmitting business, while deadlocking on separate money laundering and sanctions conspiracy counts, resulting in a mistrial on those charges.
Prosecutors built their case on a simple theory: Storm knew Tornado Cash had processed a portion of Lazarus Group’s roughly $600 million 2022 theft, kept the platform running anyway, and could not shelter behind a “neutral tool” defense that compared the mixing service to a VPN or encryption software. The jury indeed rejected that defense, on the count it did convict on.
That precedent is real, but it is neither settled nor uncontested. Storm has appealed, and the industry has put meaningful money behind reversing it. The Ethereum Foundation pledged $500,000 directly to his defense plus up to $750,000 in matching funds for community donations, as much as $1.25 million from the Foundation alone; Ethereum co-founder Vitalik Buterin and Paradigm’s Matt Huang have contributed personally; and Coin Center, the DeFi Education Fund, and the Blockchain Association have filed amicus briefs. None of that is evidence the backers are complicit in anything. It is evidence of how much is riding on overturning the exact knowledge-plus-inaction theory that would apply just as easily to a trading platform that keeps operating after learning a sanctioned actor is using it.
Who's Exposed
The exchanges that received the Lazarus proceeds, Kraken, LBank, and KuCoin, now hold funds with a documented sanctions-evasion trail attached, and Bank Secrecy Act and anti-money-laundering obligations, including suspicious activity reporting and OFAC screening, apply to them regardless of what DOJ’s current charging posture looks like. Those are civil and regulatory obligations, not contingent on any criminal prosecution being filed.
The more forward-looking exposure sits with any institution now discussing a path onto a Hyperliquid-linked U.S. product, reportedly including Kraken’s parent company. Onboarding to a venue with a repeated, documented pattern of state-sponsored sanctions evasion is a live custody and counterparty-liability question, not a hypothetical one, and it predates whatever the CFTC ultimately decides about a formal onshoring pathway.
Given Blanche’s current posture, a DOJ criminal referral tied to this specific episode is less likely than it would have been under the prior enforcement approach. The more probable routes run through CFTC civil authority, FinCEN, OFAC enforcement, or private civil litigation rather than a DOJ indictment, a distinction that should shape how counsel frames risk for clients touching this space.
What Litigators Should Watch
Four questions are worth tracking over the next two quarters:
- whether any CFTC pathway for Hyperliquid includes AML or identity-verification conditions, or preserves the no-ID structure that made this episode possible;
- whether any enforcement action, criminal or civil, follows from this specific $30 million episode;
- whether Storm’s appeal narrows or widens the liability theory available against a trading platform, as opposed to a mixing service, in a future case;
- and whether public blockchain forensics, the kind Arkham produced here, becomes the evidentiary backbone of a private civil suit the way it has already become the backbone of the press coverage.
That last question is where forensic expert testimony stops being background color and starts being the case.
Why This Matters
This episode does not need a hypothetical to make its point. A platform under active consideration for U.S. legitimacy was, in the same three-week window, a functioning pipeline for a sanctioned state actor’s stolen funds, and the government’s own responses to that fact do not agree with each other.
Three risks follow:
- Regulatory whiplash. One arm of the federal government is negotiating how to legitimize Hyperliquid, a second is lobbying to constrain it, and a third has stepped back from the criminal enforcement tools that would otherwise apply to the conduct sitting in the middle of that fight.
- An unsettled liability theory. The Storm conviction shows a platform can be held criminally liable for knowingly continuing to serve a sanctioned actor, but that theory is under well-funded appeal, and DOJ’s current posture makes a criminal case less likely regardless of how the appeal is decided.
- Forensics ahead of enforcement. A private analytics firm, not a government agency, produced the tracing that made this episode public. Private-sector forensics doing what used to be investigators’ work is becoming the default, not the exception.
For litigators and risk managers working in derivatives, AML, and DeFi platform liability, the forensic trail and the unsettled legal theory behind it are worth tracking closely, not as a crypto curiosity but as the shape future cases in this area are likely to take.
Sources and References
Press Coverage
- CoinDesk (Aug. 31, 2026), “North Korean hackers are moving tens of millions on Hyperliquid as Trump pushes to onshore the crypto platform”
- CoinDesk (Aug. 19, 2026), “HYPE jumps 11% as Trump says CFTC is working to bring Hyperliquid to U.S.”
- CoinDesk / Bloomberg (May 15, 2026), “CME, ICE push U.S. regulators to scrutinize Hyperliquid over manipulation risks”
- Steptoe (Apr. 2025), “Deputy Attorney General Memorandum: ‘Ending Regulation by Prosecution’”
- Money Laundering Watch (Aug. 2025), “Tornado Cash Jury Deadlocked on Most Serious Charges, but Convicted Founder Roman Storm…”
- Cointelegraph, “Ethereum Foundation pledges $500K to Roman Storm’s defense”
- ProPublica, “Top DOJ Official Todd Blanche Shut Down Crypto Enforcement While Holding Crypto Assets”
- Picus Security (citing FBI), “FBI Confirms North Korean Lazarus Group Behind $1.5 Billion Bybit Crypto Heist”
Navesink International Analysis
- Navesink International, “Meet the Perps – The Futures Kind”