The Lazarus Group, a North Korean state-sponsored hacking organization, has amassed a significant Bitcoin portfolio, surpassing the holdings of several countries. Arkham Intelligence data reveals the group controls over 13,500 BTC, valued at over $1.1 billion, alongside 13,700 Ethereum worth $26.1 million. This brings their total crypto holdings to an estimated $1.16 billion.
Table Content:
Lazarus Group’s Crypto Heist and Bitcoin Accumulation
A key factor contributing to the group’s substantial Bitcoin holdings is the February 2025 hack of Bybit, a UAE-based crypto exchange. This heist, considered the largest to date, resulted in the theft of approximately $1.46 billion in crypto assets, predominantly Ethereum. The Lazarus Group subsequently converted a significant portion of these stolen assets into Bitcoin.
Following the laundering of these proceeds, the Lazarus Group has emerged as a major Bitcoin holder. On-chain analytics platform Bibo indicates that the group now possesses 13,518 Bitcoin, exceeding the holdings of Bhutan (13,029 BTC), El Salvador (6,089 BTC), and Finland (1,981 BTC).
Lazarus Group vs. National and Corporate Bitcoin Reserves
While the Lazarus Group’s Bitcoin holdings are substantial, several countries still maintain larger reserves. The United States (207,189 BTC), China (194,000 BTC), the United Kingdom (61,000 BTC), and Ukraine (46,351 BTC) all possess significantly more Bitcoin than the hacking group.
Furthermore, prominent companies like MicroStrategy (499,096 BTC), Block.one (140,000 BTC), Tether Holdings (83,758 BTC), Marathon Digital Holdings (40,435 BTC), and Riot Platforms (18,221 BTC) also dwarf the group’s holdings. Crucially, these governmental and corporate holdings were acquired through legitimate means, unlike the Lazarus Group’s illicit activities.
Continued Cyberattacks and Security Concerns
The Lazarus Group’s illicit activities continue. On March 17, 2024, Seychelles-based crypto exchange OKX reported a hacking attempt by the group, leading to a temporary suspension of its decentralized exchange aggregator. This incident underscores the ongoing threat posed by the Lazarus Group to the cryptocurrency ecosystem.
Conclusion: The Implications of Lazarus Group’s Bitcoin Holdings
The Lazarus Group’s substantial Bitcoin holdings, derived from large-scale cybercrime, raise significant concerns about security within the cryptocurrency space. Their continued activity highlights the need for robust security measures and vigilance against state-sponsored cyberattacks. The scale of their accumulated Bitcoin underscores the potential for illicitly obtained funds to disrupt financial markets. While several nations and corporations hold larger Bitcoin reserves, the origin of the Lazarus Group’s holdings differentiates them, raising critical questions about the future of cryptocurrency security and regulation.
