North Korean-linked hackers have moved more than $30 million in Bitcoin through Hyperliquid over approximately three weeks, according to blockchain analysis firm Arkham, raising urgent questions about whether a decentralized exchange can operate legally in the United States without importing serious sanctions and money-laundering risks. The discovery arrives at a critical moment, as President Donald Trump and the Commodity Futures Trading Commission (CFTC) are actively working to bring the offshore derivatives platform within American regulatory boundaries through a partnership with Payward, the parent company of Kraken.

What Is Hyperliquid and Why Does Its U.S. Entry Matter?

Hyperliquid is a decentralized derivatives exchange that operates offshore, allowing traders to access perpetual futures contracts without traditional geographic restrictions. The platform has grown increasingly popular among U.S. traders despite being geoblocked, and its native token, HYPE, reached an all-time high of $86.71 on August 27. The proposed onshoring arrangement would not give Hyperliquid a direct U.S. license. Instead, Payward would offer American registered traders access to a limited subset of Hyperliquid-linked perpetual futures through Bitnomial, a CFTC-regulated clearinghouse and derivatives venue that Payward acquired in May 2026 for $550 million.

This structure matters because it represents a novel approach to bringing decentralized finance (DeFi), which typically operates without gatekeepers or customer verification, into the American regulatory perimeter. However, the North Korean money flows highlight the central tension: permissionless DeFi was designed to avoid the compliance overhead that traditional finance requires, including customer identity verification, sanctions screening, and market surveillance.

How Much Crypto Has North Korea Stolen, and What Does It Fund?

The scale of North Korean cryptocurrency theft is staggering. Chainalysis estimates that North Korea stole over $2 billion in cryptocurrency in 2025 alone, marking its most successful year ever for digital asset theft. CertiK, another blockchain security firm, has documented that the Democratic People's Republic of Korea (DPRK) has stolen approximately $6.75 billion across 263 separate incidents since 2016. These stolen funds are not hoarded; they are actively laundered into fiat currency to finance the regime's weapons programs, according to a report published by the Royal United Services Institute (RUSI) on August 11.

The RUSI report called for stricter onboarding processes and improved information-sharing rules among virtual asset service providers to combat this activity. The discovery of $30 million flowing through Hyperliquid in just three weeks demonstrates that the problem is not theoretical; it is happening in real time on platforms that regulators are considering bringing onshore.

What Are the Key Regulatory and Compliance Challenges?

Bringing a decentralized platform into the U.S. regulatory framework requires addressing several interconnected challenges:

• Customer Verification: Traditional exchanges require Know Your Customer (KYC) processes to verify user identity and beneficial ownership, a practice that DeFi platforms have historically minimized or eliminated entirely.
• Sanctions Screening: U.S. regulators must ensure that no funds flow to sanctioned individuals, entities, or jurisdictions, including North Korea. Arkham's data shows that Lazarus Group, a North Korean hacking collective, has been moving stolen assets through Hyperliquid, but it remains unclear whether the exchange or Payward would have the tools to detect and block such activity.
• Market Surveillance: Regulators need real-time visibility into trading patterns to detect price manipulation, spoofing, and other market abuse. Decentralized platforms operate on transparent blockchains, but this transparency does not automatically translate into regulatory compliance infrastructure.

Hyperliquid has not publicly explained how its architecture could screen or block wallets linked to Lazarus Group or other sanctioned actors. This silence is particularly notable given that the platform faced similar criticism in December 2024 regarding North Korean wallet activity. At that time, Hyperliquid stated that no hacking or user fund loss had occurred, but the new Arkham data suggests the association has persisted and even grown as Hyperliquid's U.S. user base has expanded.

How Is the Onshoring Deal Structured, and What Remains Uncertain?

The proposed arrangement between Hyperliquid, Payward, and the CFTC is not a purchase or acquisition of an existing exchange license. Instead, it is a commercial partnership in which Payward would use its existing CFTC registrations to offer Hyperliquid-related products to U.S. customers. Payward has already submitted the basic structure to the CFTC, but final regulatory approval remains pending, and no public timeline, registration terms, or product-specific compliance framework has been disclosed.

The commercial incentives are significant. Hyperliquid allocates 99 percent of protocol fees to its Assistance Fund, which automatically converts trading fees into HYPE tokens and burns them, permanently removing them from circulation. As of August 23, the fund had acquired and burned 46.7 million HYPE tokens, representing 4.7 percent of the initial token supply. However, it remains unknown whether trading volume routed through Bitnomial would contribute to this fee-burning mechanism or how the commercial agreement between Payward and Hyperliquid would split revenue.

During a White House meeting on August 19, Trump referred to CFTC Chairman Michael Selig as playing an important role in making Hyperliquid "fully compliant and legal," a comment that sparked a 17 percent price spike in HYPE. However, other major market participants have taken a more skeptical stance. CME Group and ICE, both of which participated in the same White House meeting, have reportedly pushed regulators to investigate Hyperliquid for price manipulation and sanctions exposure.

What Do Institutional Investors and Market Participants Think?

Despite the regulatory uncertainty and sanctions concerns, institutional interest in Hyperliquid has grown. Bitwise, a major cryptocurrency asset manager, launched a spot Hyperliquid ETF (exchange-traded fund) called BHYP on May 14, which trades on NYSE Arca and uses Anchorage Digital Banking as its digital asset custodian. This move signals that some institutional players view Hyperliquid as a legitimate investment vehicle, even as the onshoring proposal remains unresolved.

The tension between institutional adoption and regulatory risk is stark. HYPE reached its all-time high on August 27 without a single U.S. trader using the proposed Bitnomial route, suggesting that the token's value is being driven by anticipation of onshoring approval rather than actual regulatory progress.

What Happens Next, and Why Does It Matter?

Onshoring remains a proposal, not an approval. Payward and Hyperliquid have declined to comment on the specifics of their arrangement, and the CFTC has not issued any public guidance on whether it will approve the structure or what conditions it might impose. Until regulators act, the fundamental question remains unresolved: can a permissionless, decentralized platform be brought into the American regulatory perimeter without importing the sanctions and money-laundering risks that it was designed to avoid?

The North Korean money flows documented by Arkham serve as a concrete reminder of what regulators would be signing up to police if they approve the onshoring deal. The discovery that $30 million in stolen cryptocurrency moved through Hyperliquid in just three weeks underscores the scale and speed of the challenge. Whether the CFTC, Payward, and Hyperliquid can design compliance systems robust enough to prevent such activity while preserving the platform's appeal to traders remains the central open question.

" }