N. Korea’s BTC Holdings Exceed El Salvador and Bhutan After $1.4B Bybit Hack: Arkham

North Korea has emerged as one of the biggest nation-state holders of Bitcoin (BTC), surpassing both Bhutan and El Salvador in total holdings. Data from Arkham Intelligence reveals that the country’s infamous Lazarus Group currently controls 13,518 BTC, valued at approximately $1.13 billion.

Notably, this positions North Korea ahead of Bhutan, which holds 10,635 BTC, and El Salvador, with 6,118 BTC. Bhutan’s Bitcoin reserves stem from its large-scale mining initiatives, while El Salvador has steadily expanded its holdings since adopting Bitcoin as legal tender in 2021.

Lazarus Group’s Crypto Heist Bolsters Holdings

A significant portion of North Korea’s bitcoin holdings appears to be linked to Lazarus Group’s recent $1.4 billion exploit on crypto exchange Bybit, which took place on February 21. The attack, which is considered the largest crypto exchange hack to date, saw the group convert a substantial portion of stolen Ether into Bitcoin.

Despite international sanctions and other measures aimed at curbing cybercrime, North Korean-backed hacking activities remain a persistent threat. The Lazarus Group has been implicated in numerous high-profile crypto heists over the years, stealing billions by exploiting security vulnerabilities in exchanges and decentralized finance (DeFi) platforms.

A History of Notorious Hacks

A report analyzing Lazarus Group’s operations from 2017 to 2025 highlights its involvement in some of the most devastating crypto hacks. One of the group’s earliest major attacks targeted Bithumb, a South Korean crypto exchange established in 2014. In June 2017, the hackers infiltrated Bithumb’s systems using phishing, social engineering, and malware, stealing over $7 million worth of digital assets.

The following year, Lazarus Group was linked to the $534 million Coincheck hack in Japan. The attackers reportedly used spear-phishing techniques to gain unauthorized access to the exchange’s infrastructure, making it one of the most significant crypto thefts in history.

In 2019, South Korea’s largest crypto exchange, Upbit, fell victim to a Lazarus-led attack. The hackers exploited security vulnerabilities, including phishing and API manipulation, to drain approximately $49 million from the platform’s hot wallet.

Other notable incidents attributed to the group include the $625 million Ronin Bridge hack in 2022 and the KuCoin exchange exploit in 2020. These incidents highlight the ongoing risks posed by North Korean cybercriminals, whose tactics continue to evolve despite international countermeasures.