North Korea becomes third-largest Bitcoin-holding government after $1.46 billion Bybit hack

North Korea has risen to third place among governments in terms of Bitcoin holdings following a massive $1.46 billion cryptocurrency theft. On Feb. 21, hackers from the Lazarus Group, a cybercriminal organization reportedly affiliated with the North Korean government, stole close to 401,000 units of Ethereum (ETH) from Bybit, one of the world’s largest cryptocurrency exchanges. Shortly after the attack, the group converted a large part of the stolen funds into Bitcoin, boosting North Korea’s total holdings to 13,562 BTC, valued at approximately $1.14 billion.

The United States, which recently established its Strategic Bitcoin Reserve (SBR), remains the world's largest government Bitcoin holder, possessing 198,109 BTC, worth $16.71 billion. The United Kingdom follows with 61,245 BTC (approximately $5.17 billion). Following the heist, North Korea overtook Bhutan (10,635 BTC, $898 million) and El Salvador (6,117 BTC, $516 million) in Bitcoin holdings.

North Korea’s surge in cryptocurrency reserves came just days before March 6, when U.S. President Donald Trump signed an executive order establishing the SBR.

Despite global efforts to track and freeze the stolen cryptocurrency, North Korean hackers have already managed to launder approximately $300 million from the Bybit theft.

“Every minute matters for the hackers who are trying to confuse the money trail, and they are extremely sophisticated in what they’re doing,” commented Tom Robinson, co-founder of blockchain analytics firm Elliptic, which monitors illicit cryptocurrency transactions. Stolen assets are funneled through a complex laundering process, with experts warning that the funds are used to finance North Korea’s nuclear and military programs.

The U.S. and its allies have repeatedly accused North Korea of carrying out dozens of cryptocurrency hacks over the past decade. Pyongyang’s reliance on stolen digital assets are critical to its efforts to mitigate the effects of international sanctions.

Initially known for targeting banks, Lazarus Group has shifted its focus entirely to cryptocurrency exchanges over the past five years. Experts warn that the group's evolving tactics and the increasing scale of its thefts pose a growing threat to the global financial system.