North Korea has reportedly become one of the largest state holders of Bitcoin, following the substantial cyber heist targeting the crypto exchange Bybit.
On February 21, 2025, the notorious North Korean hacking collective known as the Lazarus Group executed a sophisticated attack on Bybit, resulting in the theft of approximately $1.5 billion in various cryptocurrencies, primarily Ethereum.
Subsequent investigations revealed that the group swiftly converted a substantial portion of these stolen assets into Bitcoin.
Data indicates that North Korea now possesses approximately 13,562 BTC, valued at around $1.14 billion at current market rates. This accumulation propels North Korea ahead of nations like Bhutan and El Salvador in terms of Bitcoin reserves.
For context, Bhutan’s holdings stand at 10,635 BTC (approximately $897.6 million), while El Salvador’s reserves total 6,117 BTC.
Global Rankings of Government Bitcoin Holdings
The current hierarchy of government-held Bitcoin reserves is as follows:
- United States: 198,109 BTC (approximately $16.71 billion)
- United Kingdom: 61,245 BTC (approximately $5.17 billion)
- North Korea: 13,562 BTC (approximately $1.14 billion)
- Bhutan: 10,635 BTC (approximately $897.6 million)
- El Salvador: 6,117 BTC (approximately $510227751 million)
Notably, the United States and the United Kingdom acquired their Bitcoin holdings predominantly through asset seizures related to criminal investigations, whereas North Korea’s accumulation is attributed to cyber theft conducted by the Lazarus Group.
Prior to the Bybit incident, the Lazarus Group had orchestrated multiple high-profile cyberattacks targeting global cryptocurrency platforms. In 2024, they executed a $308 million theft from Japan’s DMM Bitcoin and a $615 million heist from the Ronin Network in 2022.
Beyond Bitcoin, the Lazarus Group maintains a diversified portfolio of approximately $30 million in other cryptocurrencies, including Ethereum (ETH), Binance Coin (BNB), Dai (DAI), and Binance USD (BUSD).
Cryptocurrency Theft: A Pillar of DPRK’s Funding
In 2023, a White House official indicated that North Korea finances approximately half of its weapons of mass destruction and ballistic missile programs through cyberattacks and cryptocurrency thefts.
Despite international sanctions and collaborative efforts to curb digital thefts, North Korean-backed cybercrime continues unabated. The regime’s adeptness at circumventing financial restrictions through sophisticated cyber operations poses ongoing challenges to global cybersecurity and financial systems.
Industry Trends and Market Impact
The incident involving North Korea aligns with a broader pattern of state and non-state actors exploiting weaknesses in cryptocurrency platforms to amass digital assets. Such activities not only threaten the integrity of the crypto market but also pose challenges for regulatory bodies striving to implement effective oversight.
The increasing involvement of nation-states in cryptocurrency accumulation, whether through legitimate means or illicit activities, is reshaping the dynamics of global financial systems and prompting discussions on the need for enhanced security measures and regulatory frameworks.
Quick Facts:
- On February 21, 2025, the Lazarus Group stole approximately $1.4 billion from the crypto exchange Bybit, primarily in Ethereum.
- Conversion to Bitcoin: The group converted a significant portion of the stolen assets into Bitcoin, amassing about 13,562 BTC (approximately $1.14 billion).
- This accumulation positions North Korea as the third-largest government holder of Bitcoin, surpassing Bhutan and El Salvador.
