Lazarus Group Amasses 13,562 BTC, Exceeding Bhutan’s Reserves

• North Korea’s Lazarus Group now holds 13,562 BTC, surpassing the Bitcoin reserves of El Salvador and Bhutan.
• The group stole over $1.5 billion in Ethereum this year, using advanced cyber tactics to expand its holdings.

Lazarus Group, a North Korean hacker group, was revealed that they currently own 13,562 Bitcoin (BTC) valued around $1.14 billion.

Second only to the United States and the United Kingdom, this sum surpasses the Bitcoin reserves of El Salvador and Bhutan, so North Korea is among the nations with the biggest BTC reserves worldwide. Unlike those nations that legally collect Bitcoin, Lazarus Group acquired these assets via several cyberattacks.

BREAKING:

NORTH KOREA’S LAZARUS GROUP NOW HOLDS 13,562 $BTC WORTH $1.14B.

THAT'S MORE THAN EL SALVADOR & BHUTAN.

NOW THE 3RD LARGEST GOVERNMENT BTC HOLDER AFTER THE U.S. & U.K. pic.twitter.com/x62NRG4FEf

— Crypto Rover (@rovercrc) March 16, 2025

Lazarus Group: Masterminds of the Biggest Crypto Heist

The brains behind a slew of major digital asset thefts is Lazarus Group. Stealing more than $1.5 billion in Ethereum from the Bybit crypto exchange this year, they broke a record. Among the biggest hacks in the annals of the crypto sector is this one.

The FBI even urged the cryptocurrency sector not to engage with the earnings of the crime and explicitly connected North Korea to the situation.

As the hack victim, Bybit has verified the occurrence and pledged to pay affected users. They are also stepping up security protocols to stop strikes going forward. This event, however, reveals how increasingly sophisticated hackers are in doing their activities.

Increasingly Sophisticated Hacking Tactics

Lazarus Group is depending not just on direct attacks on cryptocurrency exchanges. The CNF report reveals that a recent analysis by Socket Research revealed the group used six malicious packets downloaded more than 330 times. These packages are meant to pilfer login passwords, install backdoors, and exfiltrate private information from Solana and Exodus crypto wallets.

Moreover, the investigation exposed that the methods applied in this attack are reminiscent of past Lazarus operations. Targeting victims’ browser profiles, they can access Chrome, Brave, Firefox, even the macOS keychain to gather important data.

Massive Crypto Thefts Fuel Geopolitical Tensions

Globally, Lazarus Group and other North Korean hacker organizations are accountable for crypto theft valued at over $659 million this year.

Among them, some of the more well-known ones involve $308 million from DMM Bitcoin in Japan and $235 million taken from the WazirX exchange in India. These expensive strikes even caused DMM Bitcoin to be compelled to close down its activities.

These events led the United States, Japan, and South Korea to publish a joint statement alerting of cyber risks from North Korea. They claimed that the nation’s nuclear and missile projects were funded from the earnings of these crimes. Stated differently, hacking is a component of a larger geopolitical strategy in addition to an illicit economic venture.

Though the crypto space has always provided freedom and decentralization, it has also been a rich field for criminals like the Lazarus Group. The risk to digital assets does not seem to be reducing anytime soon as hacking technologies and methods keep developing.