What happened
Wallets attributed to North Korea's Lazarus Group offloaded more than $30 million in Bitcoin through Hyperliquid between mid-August and this weekend, Arkham's tracing shows. The flows didn't stop at BTC. The addresses rotated proceeds into ETH and SOL on the venue's order book, a pattern consistent with prior Lazarus laundering cycles that lean on liquid majors to obscure origin.
Crypto. News reported the activity on Sunday, tying it to the same window in which US officials and Payward, Kraken's parent company, have been exploring a regulated access arrangement with Hyperliquid. Neither Hyperliquid nor Payward has published a statement addressing the wallet-specific activity as of publication.
Why it matters
Hyperliquid is the largest onchain perps venue by open interest and has spent most of 2026 fending off questions about counterparty screening. A confirmed Lazarus flow of this size, on this venue, in the exact week Payward is negotiating a compliant on-ramp, is the worst possible split-screen for the protocol. It hands regulators a live example of the sanctions gap between centralized brokers and permissionless order books.
It also complicates Payward's pitch. Any Kraken-branded access lane will now be judged against what the underlying book was doing while the term sheet was being drafted. The DPRK attribution isn't ambiguous either.
Arkham's Lazarus cluster is one of the more heavily corroborated in the industry, cross-referenced against TRM, Chainalysis, and FBI advisories over the past two years.