North Korean hackers are moving tens of millions on Hyperliquid as Trump pushes to onshore the crypto platform

Decentralized perpetual exchange Hyperliquid finds itself at the intersection of national security concerns and domestic political ambitions. On-chain intelligence confirms that wallets associated with North Korea’s state-backed Lazarus Group have offloaded more than $30 million in bitcoin through the platform in the last three weeks alone. For an ecosystem that has swiftly established itself as a premier venue for high-frequency DeFi traders, this surge of illicit capital illustrates the persistent tension between deep, permissionless liquidity and regulatory compliance. The timing presents a complex challenge for Hyperliquid’s core builders and institutional backers. Donald Trump’s aggressive campaign to onshore high-volume crypto infrastructure—part of a broader strategy to solidify domestic dominance over digital asset capital markets—implicitly hinges on these platforms operating within clear regulatory boundaries. While policymakers envision pulling offshore trading activity under a tailored U.S. framework, the on-chain reality demonstrates how sophisticated threat actors adapt. Lazarus’s pivot toward Hyperliquid reflects a broader shift away from traditional coin mixers, favoring high-throughput order book protocols capable of absorbing massive order flows with minimal price slippage. For developers building on application-specific Layer 1s and perp DEXs, this activity highlights an operational vulnerability. Implementing robust compliance controls on decentralized architectures is notoriously difficult. Unlike centralized venues that rely on integrated risk feeds to block compromised addresses instantly, decentralized protocols often balance censorship resistance with transaction speed. If U.S. enforcement agencies make strict wallet-level sanctions screening a mandatory condition for domestic integration, development teams may be forced to mandate middleware filtering at the RPC or front-end level, risking friction with community members who prioritize absolute decentralization. For institutional investors and liquidity providers, the situation yields a mixed signal. The ability of Hyperliquid's order books to absorb tens of millions in distressed bitcoin sales without distorting funding rates confirms its technical maturation and deep liquidity. However, serving as an unwitting off-ramp for sanctioned regimes turns the platform into a high-priority target for federal agencies. As Washington works to redraw the boundaries of domestic crypto oversight, platforms seeking entry into the U.S. market will discover that offering uncensored execution carries a significant regulatory premium. Market participants must now factor potential regulatory intervention into their yield and risk calculations as state-level actors test the limits of permissionless finance.