North Korea Surpasses El Salvador in Bitcoin Holdings, Fueled by Bybit Hack

Key Takeaways:

• North Korea’s Bitcoin holdings now surpass those of El Salvador and Bhutan.
• The Lazarus Group, linked to North Korea, converted assets from the Bybit hack into Bitcoin.
• These cyber activities contribute to North Korea’s funding of its weapons programs.

North Korea surpassed El Salvador and Bhutan in Bitcoin (BTC) holdings after the Lazarus hacker group converted stolen assets from the Bybit hack into Bitcoin, according to Arkham data as of March 17.

Arkham data shows that Lazarus, responsible for the record $1.5 billion Bybit hack, converted the stolen Ether to 13,518 Bitcoin (worth $1.14 billion).

The group also holds nearly 13,791 Ether and 5,022 Binance Coin (BNB), valued at $26.68 million and $3.16 million, respectively.

These holdings position North Korea ahead of Bhutan’s 10,635 mined Bitcoin and El Salvador’s 6,118 Bitcoin.

Bitcoin Treasuries data places the US, China, the UK, and Ukraine ahead, with reserves of 198,109, 190,000, 61,245, and 46,351 BTC.

North Korea’s vast wealth in cryptocurrencies stems from years of cyberattacks and crypto heists, including the 2024 DMM Bitcoin exploit in Japan and the 2022 Ronin Network breach, where Lazarus stole $308 million and over $600 million, respectively.

The Lazarus Group refers to a large subset of state-sponsored cyber activities of the Democratic People’s Republic of Korea (DPRK), operating as an integral wing of North Korea’s central foreign intelligence agency, the Reconnaissance General Bureau (RGB).

Chainalysis’ Crypto Crime 2025 Report shows North Korean hackers stole $660.5 million in 2023 and $1.34 billion in 2024, marking a 102.88% year-over-year increase.

One of the most recent examples of North Korea’s expanding cyber operations is the Bybit hack.

The dramatic increase in North Korea’s Bitcoin holdings is directly linked to the February 2025 attack on the Dubai-based cryptocurrency exchange Bybit.

The Lazarus Group organized the theft of over 400,000 Ether from Bybit’s secure multi-signature cold wallet.

Following the theft, Lazarus employed sophisticated techniques to launder the stolen Ether and convert it into Bitcoin.

The group exploited decentralized finance (DeFi) protocols like THORChain, which faced criticism for lacking strong anti-crime protections.

This allowed Lazarus to obscure the origins of the stolen funds and facilitate their conversion into Bitcoin.

This attack has consequences beyond Bybit’s financial losses.

According to the Center for Strategic & International Studies (CSIS), proceeds from cyberattacks, along with other illicit wealth generated by North Korean-funded syndicates, fund North Korea’s nuclear missile program and pose a major threat to international security.

The post North Korea Surpasses El Salvador in Bitcoin Holdings, Fueled by Bybit Hack appeared first on Cryptonews.