The Democratic People’s Republic of Korea cheated its way into the upper echelons of sovereign Bitcoin holders when the Lazarus hacker group stole over USD$1.4 billion from the Bybit exchange.
According to Arkham data, Lazarus has propelled the nation’s Bitcoin holdings above holdings controlled by Bhutan and El Salvador. Now effectively Lazarus controls 13,518 BTC, which is worth in the USD$1.1 billion at the time of writing.
North Korea’s BTC wealth surged after Lazarus attacked Bybit in February. The Dubai-based crypto exchange reported that hackers stole over 400,000 Ether from its Safe multi-sig cold wallet.
Lazarus Group amassed massive wealth through numerous cyber attacks and crypto exploits over the years. These include the 2024 DMM Bitcoin exploit in Japan and the 2022 Ronin Network attack, where they stole USD$308 million and over USD$600 million in crypto, respectively.
Currently, the DPRK-tied organization holds more Bitcoin than Bhutan’s 10,635 BTC trove, which the country accumulated through large-scale mining, and El Salvador’s 6,118 BTC, attributed to its status as the first nation to adopt BTC as legal tender.
Only four known sovereign Bitcoin portfolios surpass North Korea’s holdings. U.S. authorities hold 198,109 BTC, China possesses 194,000 BTC, the United Kingdom controls 61,000 BTC, and Ukraine maintains a stash of 46,351 BTC.
Lazarus used decentralized finance protocols like THORChain to swap its portion of the stolen ETH for BTC. THORChain has been criticized by in-house developers and the crypto community for weak anti-criminal measures.
According to CNN, which cited a White House official, Lazarus’ proceeds and illicit wealth from other DPRK-funded syndicates finance nearly 50 per cent of North Korea’s nuclear missile program.
Read more: Bitfarms closes acquisition and expands into artificial intelligence
Read more: Alaska congressmen introduces new act to substantiate Bitcoin reserve
North Korea use multiple tools to launder stolen crypto
Every new emergent technology carries with it unforeseen positive and negative changes to a society.
Bitcoin offers freedom for the unbanked, the possibility of a reserve currency and potentially a solution for inflation. But it also enables countries like North Korea to evade international sanctions. It does so by providing a decentralized, censorship-resistant financial network that operates outside traditional banking systems.
Bitcoin transactions occur on a blockchain, allowing sanctioned states to move funds without oversight from financial institutions or government agencies.
North Korea has exploited this system through cyberattacks and crypto laundering schemes. Groups like Lazarus have stolen billions in cryptocurrency from exchanges. They then convert their illicit funds through decentralized finance (DeFi) protocols, mixers, and over-the-counter (OTC) markets. These tactics help obscure the origin of stolen assets, allowing North Korea to convert digital wealth into currency without detection.
By bypassing the SWIFT network and conventional financial intermediaries, North Korea can fund its nuclear weapons program and other state operations despite U.S. and U.N. sanctions.
Reports indicate that illicit crypto transactions contribute nearly 50 per cent of the country’s missile development budget. Additionally, North Korea has engaged in large-scale mining operations, accumulating Bitcoin without relying on foreign financial institutions.
Although governments have ramped up blockchain analytics and enforcement actions, Bitcoin’s pseudonymous nature still makes tracing illicit activity challenging.
Sanctioned nations continue to refine their laundering techniques, leveraging decentralized exchanges (DEXs) and privacy-enhancing tools to maintain access to markets. There’s also the probability of North Korea and countries like it moving to cryptocurrencies offering stronger anonymity features, like Monero. This could further complicate international efforts to curb illicit financing.
