How Much Bitcoin Does North Korea’s Lazarus Group Own?

North Korea’s Lazarus Group has solidified its position as one of the most notorious crypto hacking syndicates in the world. The group, backed by the North Korean regime, has been linked to some of the largest cryptocurrency thefts in history. 

Recent data from Arkham Intelligence reveals that Lazarus now holds a staggering 13,518 Bitcoin (BTC), valued at approximately $1.16 billion. This makes North Korea the third-largest government entity in terms of Bitcoin holdings, surpassing El Salvador (6,117 BTC) and Bhutan (10,635 BTC).

Lazarus Group’s Rise to the Top of Bitcoin Holdings

The dramatic increase in North Korea’s Bitcoin stash stems from its latest high-profile attack on Bybit, a major cryptocurrency exchange. The hackers stole 499,000 Ethereum (ETH) ($1.39 billion) and then converted a significant portion of the funds into Bitcoin.

According to on-chain analytics firm Arkham, the Lazarus Group’s Bitcoin holdings surged from 778 BTC before February 22 to nearly 14,000 BTC by March 4. This rapid accumulation highlights North Korea’s continued efforts to use cryptocurrency for illicit financial operations.

How the Bybit Hack Fueled Lazarus’ Bitcoin Holdings

On February 21, 2025, hackers infiltrated Bybit’s security during a routine transfer of Ethereum from a cold wallet to a warm wallet. Exploiting vulnerabilities, they siphoned funds into anonymous wallets and began laundering them through decentralized platforms.

According to reports from EmberCN, the stolen Ethereum was fully laundered within just ten days. The laundering process relied heavily on THORChain, a decentralized exchange (DEX) that handled $5.9 billion in transaction volume from illicit transactions and collected $5.5 million in fees in the process.

The attackers also used:

• Mixing services to obscure the origin of funds
• Cross-chain bridges to move assets between blockchains
• Instant swap platforms that bypass Know Your Customer (KYC) regulations

This strategy allowed Lazarus to successfully convert stolen funds into Bitcoin, further strengthening North Korea’s crypto war chest.

FBI Confirms North Korea’s Role

The Federal Bureau of Investigation (FBI) has officially linked the Bybit hack to the TraderTraitor cybercrime group, a faction within Lazarus. In a public statement on February 26, 2025, the FBI confirmed that the hackers converted stolen ETH into Bitcoin and other cryptocurrencies, dispersing the funds across thousands of addresses.

The agency warned that these assets could be further laundered and eventually cashed out into fiat currency. To combat this, the FBI has urged:

• Crypto exchanges to block transactions linked to Lazarus
• Blockchain analytics firms to track suspicious wallet activity
• DeFi platforms to implement stricter security measures

Additionally, the FBI has released a list of wallet addresses tied to the stolen assets, making it easier for exchanges to freeze funds before they can be laundered.

OKX Takes Action Against Lazarus Group

As the situation escalates, leading crypto exchange OKX has taken steps to curb further misuse of its decentralized exchange services. On March 17, OKX announced that it had temporarily suspended its DEX aggregator after detecting coordinated efforts by Lazarus Group to exploit its platform.

An OKX spokesperson stated:

“After consulting with regulators, we made the proactive decision to temporarily suspend our DEX aggregator services. This move allows us to implement additional upgrades to prevent further misuse.”

While the OKX wallet remains operational, the exchange has paused new wallet creation in select markets as a precautionary measure.

Why North Korea Is Stockpiling Bitcoin

Per reports, North Korea’s Lazarus Group isn’t just stealing crypto for profit—it’s using digital assets to fund the country’s weapons and missile programs. The U.S. government has repeatedly raised concerns over North Korea’s ability to evade sanctions by leveraging decentralized financial systems.

Bitcoin, in particular, has become a critical asset for the regime because:

1. It is censorship-resistant, making it difficult for global authorities to seize or freeze funds.
2. It provides liquidity, allowing North Korea to fund its operations without relying on traditional banking channels.
3. It can be easily laundered using decentralized exchanges and mixing services.

North Korea’s Bitcoin Holdings vs. Other Governments

With 13,518 BTC, North Korea reportedly holds more Bitcoin than El Salvador and Bhutan combined. Only two governments possess more:

1. United States – 198,109 BTC
2. United Kingdom – 61,245 BTC
3. North Korea – 13,518 BTC

While El Salvador is often seen as the world’s most Bitcoin-friendly nation, its holdings are now less than half of North Korea’s. Bhutan, another sovereign Bitcoin investor, also trails behind Lazarus.