North Korea surpasses El Salvador and Bhutan in BTC holdings following $1.4 billion Bybit hack: Arkham
Quick Take
- North Korea’s hacker group Lazarus currently owns 13,518 BTC, an amount larger than those held by the governments of Bhutan or El Salvador.
- Lazarus stole around $1.4 billion from Bybit exchange last month.
The Democratic People's Republic of Korea has become one of the largest nation-state holders of bitcoin, with the amount surpassing that of Bhutan or El Salvador.
According to data from Arkham Intelligence, North Korea's Lazarus Group currently holds 13,518 BTC (worth $1.13 billion).
This ranks North Korea above Bhutan, which owns 10,635 BTC, and El Salvador, with 6,118 BTC. Bhutan has accumulated its holdings through its extensive domestic bitcoin mining strategy, while El Salvador has continued to buy bitcoin since it proclaimed the cryptocurrency as its legal tender in 2021.
The significant boost in North Korea's bitcoin holdings apparently came from the hacker group's $1.4 billion exploit on crypto exchange Bybit on Feb. 21. Following what's considered the largest-ever hack on a crypto exchange, Lazarus swapped a large portion of the stolen ether for bitcoin, largely using DeFi protocol THORChain.
Prior to the record-setting hack on Bybit, Lazarus launched multiple cyber attacks against crypto firms globally, including a $308 million theft from Japanese firm DMM Bitcoin last year and $615 million from the Ronin Network in 2022.
Aside from its bitcoin holdings, Lazarus holds around $30 million worth of other cryptocurrencies, including ether, BNB, DAI and BUSD.
Even though North Korea's bitcoin holdings have increased, the U.S. remains the largest known holder of bitcoin, with 198,109 BTC, as it prepares to build a strategic bitcoin reserve with crypto assets seized from criminal and civil proceedings. The U.K., on the other hand, holds 61,245 BTC, Arkham data shows.
In 2023, a White House official said that North Korea funds around half of its weapons of mass destruction and ballistic missile programs with cyberattacks and cryptocurrency thefts, according to a CNN report.
North Korea-backed cybercrime remains rampant despite global efforts to prevent digital thefts, including sanctions on individuals and entities that helped launder the illicit stream of funds.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2025 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
