North Korea finds itself in a striking position, now considered to hold the third-largest reserve of Bitcoin worldwide. This unexpected status is primarily attributed to the estimated $1.5 billion in cryptocurrencies stolen through state-sponsored hacking operations.
Articles have noted that, according to a recent report by the South China Morning Post published on March 18, 2025, North Korea’s Bitcoin reserves have surged impressively, with only the US (holding 198,109 coins) and the UK (with 61,245 coins) surpassing them.
The total count of Bitcoin held by the North Korean government is 13,562, with an approximate total value of $1.14 billion as per Arkham Intelligence’s analysis.
“North Korea is now the 3rd largest #Bitcoin holder Just behind US (198,109 BTC / $16.6B) and UK (61,245 BTC / $5.1B) Funny thing is they built this position without any cost 13,562 BTC from the Bybit hack”
Translation: North Korea is now the third-largest Bitcoin holder, just behind the US and the UK. They acquired this amount without any investment through the Bybit hack.
Authorities suspect these cyber operations are leveraged as an alternative funding stream to evade the severe economic sanctions enforced by the international community.
In the preceding year, the notorious Lazarus Group from North Korea executed some of the most significant crypto heists, accounting for about 61% of all cryptocurrency thefts recorded in 2024.
The Lazarus Group’s Methods and Key Heists
The Lazarus Group, established around 2007 and with bridges to the North Korean regime, plays a pivotal role in orchestrating these cyber thefts. Notably, in February 2025, they targeted Bybit, a Dubai-based trading platform, managing to pilfer $1.5 billion in cryptocurrency, primarily Ethereum, which they later converted to Bitcoin. After the hack, Bybit disclosed that their Ethereum cold wallet had been compromised through a sophisticated attack.
In July 2024, the group inflicted a $234.9 million loss on the Indian crypto exchange WazirX, effectively stopping operations there.
The group employs various techniques—ranging from phishing to exploiting software vulnerabilities, often using synthesized identities in their operations.
Crypto Firms Tightening Security Measures
With global incidents of crypto heists escalating, firms are taking proactive measures. For instance, on March 17, 2025, Seychelles-based OKX suspended its decentralized finance (DeFi) services to prevent similar breaches.
OKX is working alongside experts to fortify their systems and has debuted a hacker address detection system designed to prevent future attacks in real-time.
Key Takeaways
- North Korea’s accumulation of Bitcoin serves as a strategy to circumvent international sanctions through cyber thefts.
- The Lazarus Group is responsible for an estimated 61% of all cryptocurrency thefts in 2024.
- Recent reports indicate that the group has started utilizing generative AI to enhance their cybercrime capabilities.
