North Korea has amassed the world's third-largest government-held Bitcoin reserve through state-sponsored cryptocurrency theft, according to security analysts and recent reports.
The reclusive nation currently holds approximately 13,562 Bitcoins valued at $1.14 billion, according to an analysis by crypto security firm Arkham Intelligence, as reported by the South China Morning Post on March 18. This positions North Korea behind only the United States (198,109 coins) and the United Kingdom (61,245 coins) in government Bitcoin holdings.
Security experts believe North Korea deploys state-backed hacking operations as an alternative revenue stream to circumvent international economic sanctions. The country's notorious Lazarus Group, a hacking collective with alleged ties to the North Korean government, was responsible for approximately 61% of all cryptocurrencies stolen globally in 2024, according to cybersecurity researchers.
In February 2025, the Lazarus Group executed one of its largest heists, targeting Dubai-based trading platform Bybit and stealing tokens worth $1.5 billion. The hackers primarily took Ethereum tokens before converting them to Bitcoin. "Unfortunately, this transaction was manipulated through a sophisticated attack. As a result, the attacker was able to gain control of the affected [Ethereum] cold wallet and transfer its holdings to an unidentified address," Bybit stated on social media following the breach.
Bybit subsequently launched a bounty program offering a 10% reward for recovered tokens. Despite these efforts, authorities have recovered only $40 million worth of the stolen cryptocurrency as of March 10.
The Lazarus Group, believed to have been organized around 2007, has a lengthy history of high-profile cyberattacks against financial institutions and cryptocurrency exchanges. In July 2024, the group targeted Indian crypto exchange WazirX, stealing $234.9 million by redirecting the company's assets to addresses under their control. The FBI previously implicated the group in a $620 million theft from Ronin Network, a blockchain platform connected to the online game Axie Infinity, in 2022.
The hacking collective employs sophisticated techniques including spear phishing campaigns, malware distribution, and exploitation of software vulnerabilities. Their operations often involve creating fake personas and utilizing advanced laundering methods to convert stolen cryptocurrency into traditional currency.
In response to the escalating threat, cryptocurrency companies are strengthening their security measures. Seychelles-based exchange OKX announced on March 17 the suspension of its decentralized finance services to counter a coordinated attack by the Lazarus Group. The company is currently under European Union investigation for allegedly laundering $100 million from the Bybit hack and could potentially lose its Markets in Crypto-Assets Regulation license.
OKX reports it is collaborating with security experts to address vulnerabilities in its systems. The company has implemented a hacker address detection system for its Web3 DEX aggregator and plans to introduce real-time tracking of hackers' addresses to block them from its centralized exchange system.
Across the industry, crypto entities are implementing enhanced security protocols, including multi-party approval systems and two-factor authentication. The sector is increasingly adopting advanced predictive technologies enabling real-time detection of potential threats.