North Korea Surpasses El Salvador in Bitcoin Holdings, Fueled by Bybit Hack

North Korea’s government-backed hackers convert stolen Bybit funds into Bitcoin. Lazarus Group’s activities fund North Korea’s nuclear program, posing a global security threat. DeFi protocols like THORChain play a role in laundering these stolen assets.

The Bybit Hack

North Korea has leapfrogged El Salvador and Bhutan in the race to accumulate Bitcoin, thanks to the audacious cyber thefts carried out by the Lazarus Group. The group converted over 400,000 Ether, stolen during the Bybit hack in February 2025, into a staggering 13,518 BTC, now valued at $1.14 billion according to Arkham. But it’s not just Bitcoin; the Lazarus Group also holds 13,791 Ether ($26.68 million) and 5,022 Binance Coin ($3.16 million). This brazen theft showcases the dark side of decentralized finance, raising serious concerns about global security.

North Korea’s Cyber Tactics

North Korea’s cyber operations have been relentless. In 2023, they stole $660.5 million, and in 2024, they ramped it up to $1.34 billion—a 102.88% increase year-over-year. These funds, laundered through DeFi protocols like THORChain, are used to fuel North Korea’s nuclear missile program. Dr. Tom Robinson from Elliptic warns, “The Lazarus Group operates with a sophistication and relentlessness that is truly alarming.” The process of laundering involves making illegally obtained money appear legal, and in this case, it’s done through DeFi platforms that allow financial transactions without traditional intermediaries.

The Role of DeFi

DeFi protocols like THORChain have become a hotbed for laundering stolen cryptocurrencies. Federico Paesano, an Investigations Lead, argues that “THORChain’s role was merely to convert, not launder, the stolen funds, as the transactions are traceable.” Yet, the controversy surrounding THORChain’s involvement has led to internal governance issues and the resignation of key developers. This situation highlights the challenges DeFi platforms face in balancing decentralization with ethical responsibility.

Implications for El Salvador and Bhutan

Once at the forefront of Bitcoin adoption, El Salvador, and Bhutan, known for its mining efforts, now find themselves outpaced by North Korea. This development serves as a stark reminder of the double-edged sword of cryptocurrency: while it empowers individuals and disrupts centralized finance, it also becomes a lucrative target for state-sponsored cybercrime.

Countermeasures and the Future of Crypto

As we champion Bitcoin’s potential to revolutionize finance, we must also confront the dark realities it brings. North Korea’s success in converting stolen assets into Bitcoin not only funds their dangerous ambitions but also serves as a wake-up call for the crypto community. Technological countermeasures like Chainalysis’s acquisition of Hexagate, which uses machine learning to detect suspicious hacking behaviors, are being developed to combat these threats. The future of money and finance hangs in the balance, and it’s up to all of us to steer it towards a brighter, more secure path.

Key Takeaways and Questions

• What has enabled North Korea to surpass El Salvador and Bhutan in Bitcoin holdings?

  The conversion of assets stolen in the Bybit hack by the Lazarus Group into Bitcoin has significantly increased North Korea’s Bitcoin holdings.

• How does North Korea’s cybercrime activity impact international security?

  North Korea uses the proceeds from these cyberattacks to fund its nuclear missile program, which poses a major threat to international security.

• What techniques does the Lazarus Group use to launder stolen cryptocurrencies?

  The Lazarus Group employs sophisticated techniques, including the use of DeFi protocols like THORChain, to launder and convert stolen cryptocurrencies into Bitcoin.

• What role do DeFi protocols play in the laundering of stolen cryptocurrencies?

  DeFi protocols like THORChain are used to obscure the origins of stolen funds and facilitate their conversion into other cryptocurrencies, such as Bitcoin.

• How significant has the year-over-year increase in North Korean cryptocurrency theft been?

  North Korean hackers stole $660.5 million in 2023 and $1.34 billion in 2024, marking a 102.88% increase year-over-year.

Despite the grim implications, it’s crucial to remember that Bitcoin and other cryptocurrencies still hold immense promise for financial freedom and innovation. The challenge lies in navigating this new frontier responsibly, ensuring that the benefits outweigh the risks.