North Korean hackers are moving tens of millions on Hyperliquid as Trump pushes to onshore the crypto platform
North Korean state-linked hackers have been identified moving tens of millions of dollars through Hyperliquid, a decentralized perpetuals trading platform, according to a report from CoinDesk published August 31, 2026. The activity has drawn significant attention from security researchers and regulators, coinciding with reported pressure from the Trump administration for Hyperliquid to establish a formal onshore presence in the United States.
Hyperliquid has grown into one of the most active decentralized derivatives platforms in the crypto space, handling billions in daily trading volume. North Korea's Lazarus Group and affiliated threat actors have a well-documented history of exploiting crypto infrastructure to generate funds that reportedly flow back into state programs. The combination of high liquidity and decentralized architecture has made platforms like Hyperliquid attractive targets for illicit fund movement.
The dual development — potential state-sponsored exploitation alongside political pressure to bring the platform under U.S. regulatory oversight — places Hyperliquid at the center of a broader debate around decentralized finance compliance. Industry observers note that if regulators succeed in compelling onshore registration, platforms may face stricter Know Your Customer and Anti-Money Laundering obligations that could limit such activity.
Market participants will be watching whether Hyperliquid responds publicly to either the security concerns or the reported government pressure, and whether additional blockchain forensics firms release further details identifying the specific wallet clusters involved.
Source: CoinDesk
