North Korea leapfrogs Bhutan, El Salvador in Bitcoin holdings after Bybit hack

The Democratic People’s Republic of Korea became the world’s fifth-largest sovereign Bitcoin holder after Lazarus stole over $1.4 billion from Bybit.

North Korean-funded terror group Lazarus has catapulted the nation’s Bitcoin (BTC) holdings above caches controlled by crypto-friendly countries Bhutan and El Salvador. Lazarus controls 13,518 BTC, worth approximately $1.1 billion at press time, according to Arkham data.

This massive wealth was amassed through numerous cyber attacks and crypto exploits over the years, like the Japanese exchange DMM Bitcoin exploit in 2024 and Ronin Network in 2022, where Lazarus stole $308 million and over $600 million in crypto, respectively.

At present, the DPRK-tied organization boasts more Bitcoin than Bhutan’s 10,635 BTC trove, which it has accumulated through large-scale mining, and 6,118 BTC attributed to El Salvador, the first country to adopt BTC as legal tender.

Currently, 198,109 BTC held by U.S. authorities, China’s 194,000 BTC trove, the United Kingdom’s 61,000 BTC hoard, and Ukraine’s 46,351 BTC stash are the only known sovereign Bitcoin portfolios bigger than North Korea’s.

The sudden jump in North Korea’s BTC wealth follows Lazarus’ attack on Bybit in February. Dubai-based crypto exchange Bybit reported that over 400,000 Ether (ETH) had been stolen from its Safe multi-sig cold wallet.

Lazarus tapped decentralized finance protocols like THORChain, which in-house developers and the crypto community criticized for lax anti-criminal measures, to swap a significant portion of the ETH to BTC. Per CNN, citing a White House official, Lazarus proceeds, and illicit wealth from other DPKR-funded syndicates finances almost 50% of North Korea’s nuclear missile program.