North Korea becomes world’s third-largest Bitcoin holder after major cyber heists

North Korea has emerged as the world’s third-largest holder of bitcoin, behind only the United States and Britain, after its notorious hackers, the Lazarus Group, pulled off a series of highly successful cyberattacks targeting cryptocurrency exchanges.

According to data published by Arkham Intelligence, a cryptocurrency monitoring firm, North Korea now holds a staggering 13,580 bitcoin, valued at $1.15 billion, following a record-breaking theft last month, Caliber.Az reports via foreign media.

Lazarus, a cybercriminal group linked to the North Korean regime, has carried out numerous hacks, and the proceeds from their operations are crucial to funding Kim Jong-un’s weapons programmes. The FBI confirmed that Lazarus stole over $1.56 billion worth of Ethereum in a recent digital raid on the Bybit crypto exchange, which is believed to be the largest theft of its kind.

Arkham Intelligence, which uses artificial intelligence to identify owners of anonymous cryptocurrency holdings, revealed that North Korea’s bitcoin holdings place it behind only Britain, with $5.06 billion, and the US, with at least $16.47 billion. Both of these nations acquired their bitcoin through the seizure of funds held by criminals.

Lazarus, also known as TraderTraitor, has become one of the most prolific cybercriminal groups globally. Last year, it stole an estimated $800 million in cryptocurrency, funds that may contribute to North Korea's nuclear and missile development programme. “As a result of its scarcity and security, bitcoin is often referred to as ‘digital gold’,” stated President Trump in an executive order, which resulted in the creation of a “strategic bitcoin reserve” worth $22 billion, sourced from criminal seizures.

The Lazarus Group’s audacious attacks are carried out under the direction of North Korea’s external intelligence agency, the Reconnaissance General Bureau. Experts from the United Nations concluded that North Korea is funding as much as 40% of its nuclear and ballistic missile programmes through “illicit cybermeans.”

Lazarus' hacking methods include phishing attacks targeting cryptocurrency exchange users, tricking them into unknowingly transferring vast amounts of funds through multiple anonymous accounts via decentralised exchanges, a process known as “layering.” Despite an appeal from Bybit, much of the stolen cryptocurrency has been moved untraceably into conventional currencies and other crypto denominations, including bitcoin.

In a report from February, crypto security firm TRM Labs revealed that North Korean-backed hackers were responsible for 35% of the $2.21 billion in cryptocurrency thefts worldwide in 2024.

North Korea’s success in cybercrime is contrasted with the restricted internet access faced by ordinary citizens, while Lazarus continues to exploit vulnerabilities in global financial systems. These activities form a significant part of North Korea’s strategy, as it bypasses traditional financial channels to fund its military ambitions.

By Aghakazim Guliyev