North Korea’s Lazarus Group Becomes Third-Largest Bitcoin Holder After Bybit Heist

North Korea’s state-affiliated hacking group, Lazarus, has reportedly converted stolen cryptocurrency into a Bitcoin reserve surpassing those of El Salvador and Bhutan, making it the third-largest government holder of BTC. The shift follows a $1.5 billion cyberattack on the cryptocurrency exchange Bybit, where Lazarus allegedly stole and laundered Ethereum before converting it to Bitcoin.

The Bybit Heist and Bitcoin Accumulation

Blockchain analysts tracking illicit transactions have linked the Bybit exploit to Lazarus Group, which has a history of targeting crypto platforms to fund North Korea’s sanctioned economy. The stolen funds were initially held in Ethereum before being moved through a series of laundering processes and eventually swapped for Bitcoin.

The group now holds approximately 13,562 BTC, valued at over $1.14 billion, reinforcing its growing presence in the digital asset space. North Korea’s crypto holdings have historically been used to circumvent international sanctions, with stolen funds reportedly funneled into the country’s weapons and missile development programs.

Lazarus Surpasses El Salvador and Bhutan

This latest accumulation of Bitcoin places North Korea ahead of both El Salvador and Bhutan in government-held BTC reserves.

• North Korea (Lazarus-linked wallets): 13,562 BTC (~$1.14B)
• El Salvador: ~5,700 BTC (~$480M)
• Bhutan: ~3,600 BTC (~$304M)

While El Salvador has openly embraced Bitcoin as legal tender and Bhutan has quietly invested in mining operations, North Korea’s accumulation has been driven by cyber warfare and illicit financial activities.

Broader Implications for Crypto Security

The rise in Lazarus Group’s holdings highlights the persistent threat posed by state-sponsored cybercrime in the cryptocurrency sector. Despite increased blockchain surveillance and global regulatory efforts, North Korea continues to exploit vulnerabilities in digital asset platforms.

Industry experts warn that such accumulation of Bitcoin by sanctioned entities could trigger further international scrutiny and regulatory crackdowns on crypto exchanges failing to implement robust anti-money laundering (AML) measures.

As security firms and global regulators track these funds, questions remain about how exchanges and protocols can strengthen defenses against state-sponsored cyber threats.