North Korea Bitcoin Holdings Top El Salvador, Bhutan After Bybit Hack

North Korea has jumped into the ranks of the world’s top government Bitcoin holders following a massive cryptocurrency theft linked to the Lazarus hacking group.

After successfully targeting cryptocurrency exchange Bybit, the North Korean-affiliated hackers have converted a substantial portion of their stolen Ethereum into Bitcoin.

This conversion has pushed North Korea past both El Salvador (6,117 BTC) and Bhutan (10,635 BTC) in national Bitcoin holdings.

The nation now ranks as the third-largest government entity holding Bitcoin globally.

Bitcoin Holdings Across Government Entities change

The distribution of Bitcoin across government entities has shifted with North Korea’s rise.

While the United States maintains its dominant position with 198,109 BTC ($16.71 billion), the overall rankings are changing as countries adopt different approaches to cryptocurrency.

The United Kingdom’s position as the second-largest government Bitcoin holder comes primarily through criminal seizures.

The authorities have confiscated 61,245 BTC (approximately $5.17 billion) from various operations.

Unlike El Salvador, which made Bitcoin legal tender, the UK’s substantial holdings resulted from law enforcement actions.

Source: @WuBlockchain | X

Bhutan’s Bitcoin reserves, managed through state-owned Druk Holdings, amount to 10,635 BTC ($897.60 million).

The small nation has quietly built its position through mining operations powered by the country’s hydroelectric resources.

El Salvador, despite its pioneering status as the first country to adopt Bitcoin as legal tender, now finds itself in fifth place with 6,117 BTC.

President Nayib Bukele’s dollar-cost averaging strategy for national Bitcoin purchases has built the country’s position gradually over time.

The situation creates a difficult situation where a sanctioned nation like North Korea has used illicit ways to get hold of a larger Bitcoin position than countries that used legitimate acquisition strategies.

North Korea’s Crypto Strategy Reveals National Security Concerns

The Lazarus Group, widely recognized as operating under the direction of North Korea’s intelligence services, has changed cryptocurrency theft into a crucial funding mechanism for the sanction-limited state.

The February Bybit attack follows a pattern of several operations targeting cryptocurrency platforms.

Cybersecurity experts tracking North Korean operations have observed that the timing of the Bybit hack, which was just days before President Trump teased the U.S. Strategic Bitcoin Reserve, may be a sign of the awareness of global Bitcoin acquisition trends among nation-states.

The geopolitical consequences of North Korea’s Bitcoin holdings may extend beyond mere financial gain.

It could potentially provide the regime with increased resilience against international pressure.

Bybit Hack Recovery Efforts Underway

Bybit has announced a massive $140 million bounty program in an effort to recover funds stolen in the February 21, 2025 hack.

Dubbed “LazarusBounty,” the initiative offers rewards to individuals who help freeze and recover the stolen assets.

The real-time tracking shows that nearly 89% of the total $1.4 billion theft is being monitored.

According to the LazarusBounty dashboard, only $2,233,947 in bounties have been awarded so far to 13 bounty hunters.

Source: LazarusBounty

The program structure offers 10% of recovered funds as rewards, with 5% going to entities that successfully freeze the funds.

Another 5% is allocated to the first reporters who helped trace the funds leading to their freezing.

The dashboard reveals the current status of the stolen assets. 88.97% ($1,124,623,715) are being tracked.

7.50% ($94,837,426) are awaiting response from exchanges or authorities, and just 3.52% ($44,534,307) have been successfully frozen.

The hack itself was one of the largest cryptocurrency thefts in history.

The proceeds are now effectively boosting North Korea’s financial reserves at a time when the country faces strict international sanctions.

Source