#cryptonews
North Korea surpassed El Salvador and Bhutan in Bitcoin (BTC) holdings after the Lazarus hacker group converted stolen assets from the Bybit hack into Bitcoin, according to Arkham data as of March 17.
Arkham data shows that Lazarus, responsible for the record $1.5 billion Bybit hack, converted the stolen Ether to 13,518 Bitcoin (worth $1.14 billion).
These holdings position North Korea ahead of Bhutan’s 10,635 mined Bitcoin and El Salvador’s 6,118 Bitcoin. Bitcoin Treasuries data places the US, China, the UK, and Ukraine ahead, with reserves of 198,109, 190,000, 61,245, and 46,351 BTC.
The group also holds nearly 13,791 Ether and 5,022 Binance Coin (BNB), valued at $26.68 million and $3.16 million, respectively.
Chainalysis’ Crypto Crime 2025 Report shows North Korean hackers stole $660.5 million in 2023 and $1.34 billion in 2024, marking a 102.88% year-over-year increase.
North Korea’s vast wealth in cryptocurrencies stems from years of cyberattacks and crypto heists, including the 2024 DMM Bitcoin exploit in Japan and the 2022 Ronin Network breach, where Lazarus stole $308 million and over $600 million, respectively.
The Lazarus Group organized the theft of over 400,000 Ether from Bybit’s secure multi-signature cold wallet.
The dramatic increase in North Korea’s Bitcoin holdings is directly linked to the February 2025 attack on the Dubai-based cryptocurrency exchange Bybit.
According to the Center for Strategic & International Studies (CSIS), proceeds from cyberattacks, along with other illicit wealth generated by North Korean-funded syndicates, fund North Korea’s nuclear missile program and pose a major threat to international security.
The group exploited decentralized finance (DeFi) protocols like THORChain, which faced criticism for lacking strong anti-crime protections.
Following the theft, Lazarus employed sophisticated techniques to launder the stolen Ether and convert it into Bitcoin.