Wallets linked to North Korea’s Lazarus Group have sold more than $30 million in Bitcoin through Hyperliquid over three weeks as U.S. officials and Payward explore regulated access to the platform.

Lazarus-linked wallets convert Bitcoin into ETH and SOL

Arkham blockchain data, wallets associated with the North Korean state-sponsored Lazarus Group sold more than $30 million in Bitcoin on Hyperliquid during the past three weeks.

The wallets used proceeds from the Bitcoin sales to purchase Ethereum and Solana before sending the assets to centralized exchanges, including Kraken, LBank, and KuCoin, according to the blockchain analysis. Crypto investigator ZachXBT first identified the addresses in 2024, while Arkham later labeled them as connected to Lazarus.

Public blockchain records show transfers between addresses but do not reveal who controls the receiving exchange accounts. CoinDesk said it could not identify the account holders or determine whether the exchanges knew about the reported source of the funds.

Kraken said compliance sits at the center of its operations and that it continuously monitors blockchain activity with support from analytics providers. According to the exchange, its controls are designed to identify and block assets connected to sanctioned wallets before they reach the platform.

LBank said it uses industry-standard compliance tools for continuous monitoring. The exchange described illicit transfers across platforms, blockchains and jurisdictions as an industry problem that no single company can independently detect or resolve.

KuCoin said it could not confirm the reported activity without reviewing the underlying wallet data. The exchange also cautioned that public blockchain records do not show every step taken after assets arrive at a centralized platform, including account restrictions, regulatory reports and other risk controls.

Hyperliquid activity raises US sanctions questions

The reported transfers carry a direct U.S. angle because the Treasury Department has sanctioned Lazarus Group and identified it as a cyber organization controlled by North Korea’s government.

U.S. authorities have linked Lazarus to several digital-asset thefts, including the $625 million Ronin Network attack in 2022. As previously reported by crypto.news, former Defense Secretary Mark Esper recently cited North Korean hacking groups while arguing that regulated domestic crypto markets could give U.S. law enforcement better access to customer and transaction records.

Using a decentralized venue can complicate enforcement because Hyperliquid allows users to connect a wallet and trade without opening a traditional brokerage account. The protocol’s public blockchain still records transactions, allowing firms such as Arkham to trace transfers between labeled addresses.

The presence of a sanctioned actor’s assets on a decentralized platform does not establish that Hyperliquid assisted the activity or knew who controlled the wallets. CoinDesk’s report also did not establish that Kraken, LBank or KuCoin credited the transferred assets to unrestricted customer accounts.

For U.S. regulators, any plan to offer Hyperliquid-linked products domestically would need to address sanctions screening, customer identification and account-level controls. Wallet checks can identify previously labeled addresses, but funds may pass through several assets or addresses before arriving at another venue.

A recent Hyperliquid testnet deployment showed how a permissioned version of its infrastructure might operate. In August, a deployer using Kraken’s name whitelisted 10 wallets and tested controls for canceling orders, reducing positions, and moving collateral.

Neither Kraken nor Hyperliquid had confirmed ownership of that deployment when the report appeared. Because Hyperliquid’s testnet permits outside deployments, the Kraken name alone did not prove that the exchange created or operated it.

Payward discusses regulated Hyperliquid access

At the same time, Bloomberg reported that Kraken parent Payward is in advanced discussions with Hyperliquid Labs over offering selected perpetual contracts to American traders through Bitnomial, its CFTC-regulated derivatives business.

People familiar with the talks told Bloomberg that Payward had presented the Commodity Futures Trading Commission with an outline of the proposed structure. Any agreement would still require regulatory approval, while the financial terms remain unknown. Payward and Hyperliquid Labs declined to comment to Bloomberg.

President Donald Trump brought the possible U.S. entry into public view during an Aug. 19 White House event. Referring to CFTC Chair Michael Selig, Trump said he understood that the regulator was working to bring Hyperliquid into the United States in a “fully compliant and legal fashion.”

A Payward arrangement would give eligible U.S. customers access through a registered operator rather than through Hyperliquid’s permissionless interface. Commodity derivatives offered to American retail traders generally must use CFTC-regulated entities, and wallet screening alone does not replace exchange, clearing, and brokerage requirements.

Payward already has the regulatory infrastructure needed to operate in the domestic derivatives market. The company completed its Bitnomial purchase in May after agreeing to pay as much as $550 million in cash and stock.

The acquisition gave Payward control of a designated contract market, derivatives clearing organization and futures commission merchant. Together, the three registrations cover trading, clearing and brokerage services under CFTC oversight.

Kraken then launched regulated perpetuals for eligible U.S. customers in June. The service allows supported users to trade spot, margin, traditional futures and perpetual futures through Kraken Pro while using Bitnomial’s regulated structure.

Hyperliquid leads decentralized perpetual trading

Hyperliquid operates its principal exchange through HyperCore, an on-chain trading system that handles order matching, margin calculations and liquidations. Users trade from connected crypto wallets, while the platform’s main permissionless interface does not require a conventional brokerage account.

Perpetual futures differ from dated futures because they have no fixed expiry. Funding payments between long and short traders help keep contract prices close to the value of their underlying assets, allowing positions to remain open as long as margin requirements are met.

DefiLlama data showed Hyperliquid had processed approximately $5.19 trillion in cumulative perpetual volume at the time of writing. Its perpetual markets recorded about $60.44 billion in seven-day volume and $204.95 billion during the previous 30 days.

Open interest stood at roughly $13.3 billion, representing the notional value of outstanding perpetual positions. DefiLlama also recorded more than $32.6 billion in cumulative liquidations on the platform, including approximately $2.25 billion over the preceding 30 days.

Beyond markets operated by the core protocol, Hyperliquid Improvement Proposal 3 allows outside builders to launch independent perpetual exchanges using HyperCore. Deployers select their contracts, collateral, leverage limits, funding settings, and price sources after staking 500,000 HYPE.

Validators can slash the stake when a deployer manipulates an oracle or violates market rules. HIP-3 operators receive half of the trading fees generated by their markets, while newer permission tools tested on the network could let individual deployers restrict access to approved wallets.

Strive, a publicly traded asset manager and Bitcoin treasury company, added 1,800 Bitcoin to its balance sheet last week, accelerating a buy program that has helped it rank among the world’s largest publicly traded corporate holders of the asset.

The company bought the BTC between Aug. 24 and Aug. 28 for roughly $143 million, paying an average price of $79,431 per coin (including fees and expenses). CEO Matt Cole confirmed the acquisition on Monday via X: https://x.com/ColeMacro/status/2094396002308440227.

Key takeaways

• Strive purchased about 1,800 BTC over Aug. 24–Aug. 28 for approximately $143 million at an average of $79,431 per BTC.
• Total holdings rose to 23,156 BTC from 21,356 BTC a week earlier, showing faster accumulation across a short window.
• The latest inflow increased Strive’s BTC exposure by roughly 8.4% in five business days, according to Adam Livingston.
• With the new buys, Strive moved ahead of Bullish to become the fifth-largest publicly traded corporate Bitcoin holder, based on industry data from BitcoinTreasuries.net.
• Strive’s purchases align with a broader market rebound that followed a U.S. Treasury announcement on bond buybacks.

Strive’s accelerated accumulation lifts it into the top tier

Strive’s latest acquisition expands its Bitcoin strategy beyond a slow, incremental approach. The purchases increased its total holdings to 23,156 BTC, up from 21,356 BTC reported a week earlier. Earlier reporting from Cointelegraph noted that Strive had added 1,110 BTC the previous week for about $81.5 million at an average of $73,409 per coin (Cointelegraph).

Adam Livingston, an adviser to Saturn Credit, highlighted the pace of change after the most recent buys. In his post, he said the latest purchase increased Strive’s holdings by approximately 8.4% within just five business days (https://x.com/AdamBLiv/status/2094404735474295249).

For investors tracking corporate treasuries, the key point isn’t only the size of the purchase, but how quickly it is happening relative to recent baselines. Rapid accumulation can also signal that a company sees improved risk conditions, more favorable liquidity, or a strategy shift from opportunistic buying toward consistent treasury scaling.

Surpassing Bullish for fifth-largest publicly traded holder

The updated Strive balance also changes the standings among listed Bitcoin treasuries. According to industry data compiled at BitcoinTreasuries.net, Strive’s latest buys pushed it past Bullish—an exchange and digital asset infrastructure firm—making it the fifth-largest publicly traded corporate holder of Bitcoin.

This matters because position in these rankings is closely watched by market participants: it can affect perceived credibility of treasury strategies, influence how investors interpret management discipline around Bitcoin exposure, and contribute to the narrative of institutionalization across the sector.

Corporate buying follows a market rebound

Strive’s purchases come as Bitcoin and risk assets rebounded broadly after Aug. 19, when the U.S. Treasury Department announced plans to double the size of certain long-term bond buybacks. The move helped reduce Treasury yields and supported a return of risk appetite, with Bitcoin rallying more than 23% to a recent high above $81,000, as noted in Cointelegraph’s market coverage (Cointelegraph markets).

While treasury purchases do not need a specific catalyst, correlations between macro conditions and corporate activity are frequently discussed in crypto markets. When yields fall and liquidity improves, companies that treat Bitcoin as a treasury asset may find it easier to justify additional exposure—particularly if market volatility cools.

Strategy’s renewed buying underscores the broader trend

Strive is not alone. Michael Saylor’s Strategy—described as the largest corporate Bitcoin holder—announced Monday that it resumed buying BTC for the first time since June. Cointelegraph reported that Strategy acquired 4,603 Bitcoin at an average price of $80,318, per its announcement (Cointelegraph).

That purchase lifted Strategy’s holdings back above 845,000 BTC after four Bitcoin sales since May, reversing a temporary reduction in exposure. Together with Strive’s accelerated accumulation, the renewed buying from a major benchmark treasury adds weight to a theme seen across the corporate segment: listed companies appear willing to increase Bitcoin exposure when market conditions are supportive.

At the same time, the Strategy example also highlights an important tension. Corporate treasuries can be both active buyers and occasional sellers, meaning investors should pay attention not just to net accumulation, but also to the operational or capital-planning drivers behind any reductions.

For the near term, traders and long-term holders will likely watch whether Strive sustains this faster pace of buying over the next several weekly reporting windows, and whether other large corporate treasuries continue to add after recent rebounds—especially as macro conditions that helped fuel the move in yields remain in focus.

Diversify your protein sources

Kalshi has permanently banned former U.S. Representative George Santos and imposed a $71,356 penalty after finding that he manipulated an attendance market to earn $17,839.57.

Kalshi’s Aug. 28 disciplinary notice said Santos placed large trades between Feb. 2 and Feb. 25 in contracts that paid according to whether he attended President Donald Trump’s 2026 State of the Union address.

Kalshi says Santos traded an outcome he could control

As the person whose attendance determined the contracts’ result, Santos had direct influence over the event. Kalshi Rule 5.17(z) prohibits members from trading contracts when they can affect the underlying outcome.

Despite the restriction, Santos bought and sold contracts tied solely to his own attendance, the compliance department found. His trades involved both “Yes” contracts, which would pay if he appeared at the event, and “No” contracts, which would pay if he did not.

During the trading period, Santos published several statements about his travel and attendance plans. Kalshi said some of the posts were false or misleading and were made to move prices before he purchased or sold the relevant contracts.

The exchange determined that the statements had their intended effect on the market. By moving between “Yes” and “No” positions while controlling information about his plans, Santos generated $17,839.57 in profit, according to the notice.

Kalshi cited violations of rules against market manipulation, trading with material nonpublic information, trading on an outcome a member can influence, and using a deceptive scheme connected to exchange activity. Its compliance department also found that Santos failed to cooperate promptly and fully with the internal investigation.

Under the settlement, Santos cannot access Kalshi directly or through another person or account. The exchange also assessed a $71,356 penalty, exactly four times the profit amount listed in its notice. The document took effect on Aug. 28.

Social media posts moved Santos attendance contracts

A separate Commodity Futures Trading Commission order issued on July 31 provided a more detailed timeline of the trades. According to the regulator, Santos opened his Kalshi account on Feb. 11 and deposited about $7,000, using the funds exclusively to trade on his own attendance.

From Feb. 12 through Feb. 22, he accumulated 30,874 “Yes” contracts at a total cost of $6,695.94. While holding the position, Santos asked his X followers whether he should wear a serious suit or a bedazzled one to the address.

Following the post, the “Yes” contract rose from about $0.15 to $0.70. Santos then sold the full position for a $3,448.43 profit and withdrew $10,146.07 through a Venmo account created four days earlier, the CFTC said.

Later on Feb. 22, an airline notified Santos that his flight to Washington, D.C., had been canceled. He booked a train that night, then posted the next morning that bad weather had made his trip difficult and suggested the address might not take place. The “Yes” price fell from $0.63 to $0.28 after the post.

On the evening of Feb. 23, Santos posted that he would attend from the House gallery. A video repeating his attendance plans sent the contract from $0.40 to $0.70, according to the federal order.

About 40 minutes after publishing the video, Santos began buying “No” contracts. He eventually acquired 23,855 contracts for $8,650.66. His train was canceled about an hour after he began building the position, but he later responded, “I am” when another user asked if he was still going.

With both his flight and train canceled, Santos had not bought another ticket when he posted on Feb. 24 that he was watching the address on an airport television. The “Yes” contract fell from $0.73 to $0.02, increasing the value of his opposing position.

Santos closed the “No” trade early on Feb. 25 for a $14,390.57 profit, the CFTC found. Combined with his earlier gain, the two positions produced the amount later addressed by the exchange’s disciplinary action.

Federal penalties remain separate from Kalshi’s lifetime ban

The Kalshi sanction is separate from the CFTC settlement, which imposed different payment amounts and a shorter restriction covering all federally registered trading venues.

As crypto.news previously reported, the CFTC ordered Santos to disgorge $17,569.98, pay a $17,500 civil penalty, and stop trading on any CFTC-registered entity for three years. Santos consented to the July order without admitting or denying its findings or legal conclusions.

The regulator applied Section 6(c)(1) of the Commodity Exchange Act and Regulation 180.1, which prohibit manipulative or deceptive conduct involving swaps. Its order classified the State of the Union event contracts as swaps because their payouts depended on a future event with possible financial, economic or commercial consequences.

Although Kalshi cited Santos for failing to cooperate with its inquiry, the CFTC recognized his cooperation in the federal investigation. The findings concern two separate reviews conducted by the exchange and its regulator.

Earlier in June, federal investigators were examining the trades after Kalshi froze the account and referred the activity to authorities. The Commodity Futures Trading Commission later resolved its part of the matter through the July settlement; the reported Justice Department inquiry has not received a publicly announced resolution.

Prediction markets add controls after insider cases

Kalshi operates as a designated contract market under CFTC oversight, making its event contracts subject to federal derivatives rules and exchange-level restrictions. Users trade contracts priced according to the perceived chance of outcomes involving politics, sports, economic data, and other public events.

Concerns about privileged information have increased as contracts tied to speeches, political decisions, and unpublished content attract more trading. In February, Kalshi imposed a $20,397.58 penalty and a two-year suspension on a MrBeast-affiliated editor over trades involving unreleased YouTube videos.

A separate federal case involves U.S. Army Special Forces member Gannon Ken Van Dyke, whom prosecutors accused of using classified information to earn about $409,881 from Polymarket contracts linked to the capture of Nicolás Maduro. A federal judge paused the CFTC case in August while the related criminal proceeding continues. Van Dyke has pleaded not guilty and disputes whether the contracts qualify as swaps.

Kalshi has also added employer-disclosure rules, a whistleblower channel, and risk reviews for proposed markets. In June, it partnered with StarCompliance so participating financial firms could connect employee accounts to internal monitoring systems.

The exchange said it conducted more than 150 investigations during the first quarter of 2026, blocked over 100 suspected insider-trading attempts and referred 20 cases to law enforcement.