News
by BSCN
March 17, 2025
The recent surge in holdings comes after the Bybit hack, where Lazarus stole 499,000 ETH ($1.39B) and laundered the funds through THORChain and other decentralized platforms.
North Korea’s Lazarus Group has solidified its position as one of the most notorious crypto hacking syndicates in the world. The group, backed by the North Korean regime, has been linked to some of the largest cryptocurrency thefts in history.
Recent data from Arkham Intelligence reveals that Lazarus now holds a staggering 13,518 Bitcoin (BTC), valued at approximately $1.16 billion. This makes North Korea the third-largest government entity in terms of Bitcoin holdings, surpassing El Salvador (6,117 BTC) and Bhutan (10,635 BTC).
The dramatic increase in North Korea’s Bitcoin stash stems from its latest high-profile attack on Bybit, a major cryptocurrency exchange. The hackers stole 499,000 Ethereum (ETH) ($1.39 billion) and then converted a significant portion of the funds into Bitcoin.
According to on-chain analytics firm Arkham, the Lazarus Group’s Bitcoin holdings surged from 778 BTC before February 22 to nearly 14,000 BTC by March 4. This rapid accumulation highlights North Korea’s continued efforts to use cryptocurrency for illicit financial operations.
On February 21, 2025, hackers infiltrated Bybit’s security during a routine transfer of Ethereum from a cold wallet to a warm wallet. Exploiting vulnerabilities, they siphoned funds into anonymous wallets and began laundering them through decentralized platforms.
According to reports from EmberCN, the stolen Ethereum was fully laundered within just ten days. The laundering process relied heavily on THORChain, a decentralized exchange (DEX) that handled $5.9 billion in transaction volume from illicit transactions and collected $5.5 million in fees in the process.
The attackers also used:
This strategy allowed Lazarus to successfully convert stolen funds into Bitcoin, further strengthening North Korea’s crypto war chest.
The Federal Bureau of Investigation (FBI) has officially linked the Bybit hack to the TraderTraitor cybercrime group, a faction within Lazarus. In a public statement on February 26, 2025, the FBI confirmed that the hackers converted stolen ETH into Bitcoin and other cryptocurrencies, dispersing the funds across thousands of addresses.
The agency warned that these assets could be further laundered and eventually cashed out into fiat currency. To combat this, the FBI has urged:
Additionally, the FBI has released a list of wallet addresses tied to the stolen assets, making it easier for exchanges to freeze funds before they can be laundered.
As the situation escalates, leading crypto exchange OKX has taken steps to curb further misuse of its decentralized exchange services. On March 17, OKX announced that it had temporarily suspended its DEX aggregator after detecting coordinated efforts by Lazarus Group to exploit its platform.
An OKX spokesperson stated:
“After consulting with regulators, we made the proactive decision to temporarily suspend our DEX aggregator services. This move allows us to implement additional upgrades to prevent further misuse.”
While the OKX wallet remains operational, the exchange has paused new wallet creation in select markets as a precautionary measure.
Per reports, North Korea’s Lazarus Group isn’t just stealing crypto for profit—it’s using digital assets to fund the country’s weapons and missile programs. The U.S. government has repeatedly raised concerns over North Korea’s ability to evade sanctions by leveraging decentralized financial systems.
Bitcoin, in particular, has become a critical asset for the regime because:
With 13,518 BTC, North Korea reportedly holds more Bitcoin than El Salvador and Bhutan combined. Only two governments possess more:
While El Salvador is often seen as the world’s most Bitcoin-friendly nation, its holdings are now less than half of North Korea’s. Bhutan, another sovereign Bitcoin investor, also trails behind Lazarus.
Disclaimer
Disclaimer: The views expressed in this article do not necessarily represent the views of BSCN. The information provided in this article is for educational and entertainment purposes only and should not be construed as investment advice, or advice of any kind. BSCN assumes no responsibility for any investment decisions made based on the information provided in this article. If you believe that the article should be amended, please reach out to the BSCN team by emailing [email protected].
Latest News
0h : 43m ago
What’s Fueling PancakeSwap’s Sudden Surge in Trading Volume?
3h : 13m ago
How Much Bitcoin Does North Korea’s Lazarus Group Own?
5h : 28m ago
LIBRA Token Co-Creator Hayden Davis' Alleged New Token: What We Know
March 15, 2025
Weekly Article Recap: 3/10-3/14
March 14, 2025
Top 7 Crypto Terms You Should Know in 2025
March 14, 2025
Latest Bitcoin Analysis: Russian Oil and US ETFs
March 14, 2025
Kaspa (KAS) vs Ripple (XRP): Head-to-Head Comparison
March 14, 2025
Solaxy and the SOLX Token Explained: An L2 on Solana