North Korean hackers move $30M in bitcoin via Hyperliquid, data reveals

North Korean state-sponsored hackers moved more than $30 million in bitcoin through Hyperliquid over the past three weeks, according to blockchain analytics firm Arkham Intelligence.

The transfers, reviewed by CoinDesk, show the hackers routed funds through the decentralized derivatives platform in a series of transactions, according to Arkham's on-chain data. The activity follows a December 2024 episode in which analysts flagged wallets linked to North Korean actors transacting on Hyperliquid. The exchange said at the time that no breaches or loss of user funds occurred.

The latest transfers indicate the platform remains a conduit for sanctioned entities despite prior warnings. Hyperliquid has grown into one of the largest venues in crypto derivatives, accounting for nearly 90 percent of the record $638 million in token buybacks across the industry this year alongside Pump.fun, according to market data. The platform's scale gives it significant influence over DeFi trading flows, making the compliance question more consequential for the broader ecosystem.

The episode could accelerate regulatory pressure on decentralized finance protocols. Policymakers may move to impose stricter know-your-customer and anti-money-laundering requirements on platforms like Hyperliquid, which operate without traditional exchange intermediaries. The platform's outsized role in the market gives regulators a high-profile target as they weigh enforcement actions against DeFi infrastructure. Any new compliance mandates could reshape how decentralized platforms handle user verification and transaction monitoring.

Market participants are watching for any official response from Hyperliquid regarding the reported transfers and potential measures to prevent illicit activity. Further market reactions could hinge on additional details about the scope and timing of the transactions, as well as any regulatory actions that follow. The incident also raises broader questions about the effectiveness of existing sanctions compliance frameworks for decentralized platforms, which lack the centralized control points that traditional exchanges use to block sanctioned addresses.

For the broader crypto market, the episode adds to a growing list of cases where decentralized platforms have been used to move illicit funds. Regulators in the United States and Europe have increased scrutiny of DeFi protocols, and this case could provide additional support for stricter oversight. Hyperliquid's response to the reported transfers will be closely watched as a test case for how decentralized platforms handle sanctions compliance. The bearish market reaction could extend to Hyperliquid-related tokens and the wider DeFi sector as investors price in the risk of regulatory intervention.

This article is for informational purposes only and does not constitute investment advice.