Hyperliquid has seen a meteoric rise since its 2023 launch, reaching over $2.1 billion in TVL, with its native token HYPE hitting a new all-time high of $44.79 and positioning itself to break into the top 10 cryptocurrencies by market capitalization.
Hyperliquid TVL and Token Price June 2025 — Source: DefiLlamaIts success is driven by a custom Layer 1 blockchain enabling ultra-fast, gasless trading; a CEX-like user experience for perpetual futures; a non-KYC, don’t-care-about-AML attitude; and an extremely successful HYPE airdrop.
It has established itself as a cornerstone within the traditionally CEX-dominated crypto derivatives market, especially for perpetual Bitcoin swaps, according to recently published figure by Velo Data.
Source: Bloomberg
A few months ago, security researcher Taylor Monahan revealed that despite the hype and the perception that Hyperliquid was becoming “Too Big To Fail,” the platform was actually built on shaky security foundations, with its validator system highly centralized, with no multisig or decentralized safeguards.
While its founders showed a rather cavalier attitude toward security concerns, even as North Korean threat groups began circling it like sharks.
Source: Taylor Monahan’s Twitter
Some, trying to deflect the very alarming nature of Monahan’s findings, suggested that DPRK hackers were only “trading” on HyperLiquid — but to quote Monahan: “Y’all, DPRK doesn’t trade. DPRK tests.”
Well, since December 2024, much has changed. There were multiple hints over the past few months that HyperLiquid was being used as a money laundering tool — but these remained unproven until just a few days ago, when news broke that Chinese police had cracked down on three cases of crypto money laundering involving HyperLiquid since March 2025.
So it’s not far-fetched to imagine that, rather than merely trading, the DPRK-linked threat groups behind the movements Monahan spotted in December may have been testing the waters — and perhaps finding success in laundering funds.
As of now, this connection remains speculative — but the active use of HyperLiquid for money laundering no longer is.
So let’s break down how launderers are able to leverage HyperLiquid to turn their tainted funds whiter than white.
The first rather convincing demonstration on how HyperLiquid could become an effective laundering tool in the hands of criminally driven individuals comes from PixOnChain, a kind of crypto Twitter influencer who focuses on trending on-chain activity.
In March 2025, they revealed what they identified as a money laundering pattern on HyperLiquid.
The strategy they describe is simple, effective, and involves manageable risk — making it attractive to individuals desperate to turn tainted funds into seemingly legitimate ones they can easily cash out.
To summarize, they structure their laundering trades so that the dirty money gets wiped out while the clean positions profit.
How do they achieve this?
Returning to the example provided by PixOnChain, it’s a two-step strategy.
First Step
The launderer first goes to no-KYC, no-scrutiny HyperLiquid, which allows extremely high leverage — 50x.
They deposit $5 million in tainted funds and, with 50x leverage, open a short position worth $250 million.
With the “dirty short” secured, step two takes place.
Second Step
Now, they move to a CEX and open $250 million in long positions funded by clean — or cleaned — funds.
While this may look like perfect hedging with a net market exposure close to zero, it’s actually rigged: the dirty funds tied to the short positions are meant to be liquidated, while the clean funds on the CEX are meant to capture the legitimate profits on the long side.
TL;DR: The goal is to make sure the losses occur on the dirty side, wiping out tainted funds, while the profits accrue in a clean account.
To guarantee this, they choose very high leverage so that even a small, 2% price increase in the shorted asset will fully liquidate the $5 million margin — something that can happen regularly with volatile assets.
This outcome becomes even more certain if they can anticipate upward price movements — whether from upcoming news, announcements, or by manipulating less liquid cryptocurrency spot markets as part of a more sophisticated laundering scheme.
PixOnChain highlights that liquidation is even more likely because traders shorting against funding fees face rising costs and may rush to close positions, causing prices to spike further and triggering a short squeeze.
Now, as anticipated, the price goes up, the “dirty short” is liquidated, and the tainted $5 million in funds vanish forever; meanwhile, the long position on another exchange gains 2% on $250 million, generating $5 million in legitimate, clean profit.
The money laundering trick is done, and our criminal can walk away with $5 million in untainted funds.
Source: PixOnChain’s Twitter
Not long after posting their breakdown of the money laundering scheme potentially happening on HyperLiquid, PixOnChain jokingly bantered about the impressive bookmarking ratio on their post, jokingly threatening to call the FBI on them.
In retrospect this may have been a good idea!
This is just bantering speculation, but it must be noted that the money laundering cases on which Chinese police worked on date back to March, when this twitter demonstration took place, make of that what you will!
Source: PixOnChain’s Twitter
We will never know if those cases were the eggs or the chickens, or none of them, but one thing is for sure, the criminals involved in those cases followed this laundry detergent recipe to the T.
“Chinese traders completed fund laundering by allegedly using Hyperliquid’s high-leverage liquidation mechanism to wash out the illicit gains. They did this by creating liquidation losses on the platform and reversing positions on centralized exchanges to earn money.”
The James Wynn Strategy
Apparently, this strategy might soon earn a name: “The James Wynn Strategy,” after Mirror Tang, founder of blockchain security firm Salus, drew a sharp comparison between the laundering method and the latest shenanigans of a certain James Wynn.
Wynn rose to (in)fame on Crypto Twitter after several massive high-leverage positions — some as large as a billion dollars — were liquidated on HyperLiquid, making headlines across multiple crypto news outlets.
What’s most intriguing about this name-coining is that it might be closer to the real money laundering MO than anyone expected.
According to dethective, a crypto sleuth who specializes in unearthing shady coins and exposing “KOLs dumping on you,” James Wynn isn’t the crazy gambler he appears to be — it’s a persona he’s built for clout and massive follower gains.
His investment strategy, while a bit risky, is actually just plain old hedging, just with oversized numbers, because he has deep pockets that allow for eye-catching leverage and dramatic unrealized PnL swings.
Source: Dethective’s Twitter
In short, James Wynn is actually far from being “Crypto’s Most Reckless Trader.”
Another Money Laundering Scenario: Betting on Long and Praying
In March 2025, a $5.2 million trading pattern on Hyperliquid, beyond the James Wynn strategy, raised suspicions of money laundering.
Unlike the previously used fake hedging strategy, this approach is even simpler and much riskier — simply trading, longing with high leverage, and hoping the bet will pay off.
The wallet involved had a suspicious trading history and seemed to be directly linked to crypto phishing schemes. The owner of this wallet deposited $5.22 million into Hyperliquid and opened two high-leverage positions: an ETH long at 50x leverage and a BTC long at 20x leverage.
The trader achieved a “100% win rate” on two swiftly executed ETH trades, closed manually and perfectly timed, netting a $2.2 million profit in two days.
One might argue it’s merely a criminal playing around on Hyperliquid — and that could indeed be true.
The money laundering aspect of this scheme intervenes after profits are made. Hyperliquid, with no KYC requirements, allows users to input a withdrawal wallet different from the one used to open positions on the platform.
This means the profits are “clean,” as the withdrawn funds are sent to an address not directly linked to the original illicit wallet.
On-chain, there appears to be no connection between the tainted wallet and the new withdrawal wallet. The “dirty” link is concealed within Hyperliquid’s internal state, and unless Hyperliquid exposes their users, there’s no reason to ever connect them — unless the launderer mistakenly reconnects them later.
Thus, a criminal using Hyperliquid can both profit and conceal the illicit nature of the realized gains, effectively obfuscating their funds.
In this case, with just two brief trades on Hyperliquid, the criminal managed to recoup nearly 43% in clean, shiny coins from their tainted holdings.
Given the risky nature of this obfuscation method, the individual who chose it may have faced challenges cashing out through traditional avenues, especially if blacklisted; thus, gambling or high-leverage trading becomes a worthwhile risk.
This move could become increasingly common in the near future, as efficiently cashing out illicit funds has become exceedingly difficult for crypto criminals — a topic we discussed at length in our Crypto Criminal Report of 2024 and our report on the eXch-Bybit money laundering saga.
The 2024 Crypto Crime ReporteXch.cx, Crypto Money Laundering and the Bybit Hack
The involvement of HyperLiquid in criminal activities has some of their users worried about a regulatory crackdown.
While the U.S. has been the proactive force shaping the biggest crypto players into law-abiding, KYC- and AML-compliant citizens over the past few years — back when crypto in 2020 was still basically the far west — that era is over.
A regulatory smackdown ending in massive sanctions and forced internal political change at privacy-focused platforms feels like a distant threat — at least for now.
In today’s regulatory paradigm, with no real incentives or credible threats, there’s no reason to believe HyperLiquid will take any meaningful action to stop the misuse of their platform for money laundering.
So, HyperLiquid, as it stands, has the potential to become a key money-laundering stop on the obfuscation routes of crypto criminals.
About us
Nefture is a Web3 real-time security and risk prevention platform that detects on-chain vulnerabilities and protects digital assets, protocols and asset managers from significant losses or threats.Nefture core services includes Real-Time Transaction Security and a Threat Monitoring Platform that provides accurate exploits detections and fully customized alerts covering hundreds of risk types with a clear expertise in DeFi.Today, Nefture proudly collaborates with leading projects and asset managers, providing them with unparalleled security solutions.Book a demo 🤝
HyperLiquid: A New Route for Crypto Money Laundering? was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.