North Korea has emerged as the world’s third-largest holder of bitcoin, trailing only the United States and Britain, following a record-breaking cyber theft last month. According to Arkham Intelligence, Pyongyang’s most notorious hacking group, Lazarus, now controls 13,580 bitcoin—worth approximately £886 million—after orchestrating a sophisticated digital heist.
Lazarus, also known as TraderTraitor, is among the world’s most successful cybercriminal organizations, with its illicit gains serving as a vital financial lifeline for Kim Jong-un’s regime. The FBI confirmed that the group stole over £1.2 billion in Ethereum in an attack on the crypto exchange Bybit, making it the largest known theft of any kind. The stolen sum surpasses the £1.1 billion North Korea allocated to its defense budget in 2023, highlighting the regime’s reliance on cybercrime to fund its nuclear and ballistic missile programs.
The hackers executed the heist through targeted email spear-phishing attacks, tricking users into approving unauthorized transactions. Using a method known as “layering,” they funneled stolen funds through multiple anonymous accounts and decentralized exchanges, making recovery efforts difficult. While Bybit has appealed for the return of the stolen assets, much of the cryptocurrency has already been converted into bitcoin and traditional currencies.
According to TRM Labs, North Korean cyber thefts accounted for 35% of the £1.7 billion stolen in crypto heists worldwide in 2024. The country’s state-backed hacking groups have a history of executing high-profile cyber raids, including an infamous attack on the central bank of Bangladesh. A United Nations panel has estimated that up to 40% of North Korea’s weapons program is funded through illicit cyber activities.
The rise of state-backed crypto hoarding has prompted global scrutiny. This month, President Trump issued an executive order creating a “strategic bitcoin reserve” worth $17 billion, citing bitcoin’s scarcity and security as a national asset. Meanwhile, the UK government continues to seize criminal crypto holdings, placing it second in global bitcoin reserves behind the United States.
As The Times UK reports, the Lazarus Group operates under North Korea’s Reconnaissance General Bureau, executing increasingly sophisticated cyberattacks while ordinary North Koreans remain cut off from internet access. With its growing digital war chest, Pyongyang’s cyber offensive remains a critical global security concern.
