North Korea’s Secret Crypto Fortune: A $1.15 Billion Bitcoin Powerhouse

North Korea’s Secret Crypto Fortune: A $1.15 Billion Bitcoin Powerhouse

North Korea now appears to hold one of the largest Bitcoin stockpiles of any government, almost all of it stolen. The holdings show how cyber theft has become a core part of the regime’s finances.

• North Korea’s Bitcoin Wealth: Blockchain analysts estimated in March 2025 that North Korea’s Lazarus Group controlled Bitcoin worth roughly $1.15 billion.
• Strategic Crypto Uses: Stolen crypto helps the regime evade sanctions and fund state programs.
• Cybercrime Ties: Most of the Bitcoin traces back to hacks of crypto exchanges, including the February 2025 Bybit theft.
• Global Security Concerns: The U.S. and the United Nations say the proceeds help pay for weapons programs.

The Rise of a Crypto Giant

In March 2025, blockchain analytics firm Arkham Intelligence reported that wallets linked to North Korea’s Lazarus Group held about 13,500 Bitcoin, worth roughly $1.15 billion at the time. That would make North Korea one of the largest known government holders of Bitcoin, behind the United States and the United Kingdom. It did not buy that Bitcoin. Its hackers stole it.

Technical Maneuvers and State-Sponsored Operations

The stockpile grew sharply after the February 2025 hack of crypto exchange Bybit, in which attackers stole about $1.5 billion in Ether. The FBI attributed that theft to North Korean hackers, part of the cluster it calls TraderTraitor and widely associated with the Lazarus Group. Much of the stolen Ether was converted to Bitcoin as the hackers laundered it.

Cryptocurrency and Sanctions Evasion

For a country cut off from the global banking system, stolen crypto is valuable. It can be moved across borders, swapped through exchanges and over-the-counter brokers, and eventually turned into cash or goods. U.S. and U.N. investigators have documented North Korea using these networks to get around sanctions on trade and finance.

Implications for Global Security

The stakes are high. U.S. officials and U.N. sanctions monitors have said cyber theft funds a large share of North Korea’s weapons programs, including ballistic missiles. That turns crypto exchange security into a national security issue.

Calls for Global Cybersecurity Collaboration

Many security and policy experts argue that stopping this requires cooperation across borders: faster freezing of stolen funds by exchanges, better tracing of laundering routes, sanctions on brokers who help cash out, and stronger security at crypto firms themselves.

Looking Towards the Future

North Korea’s Bitcoin stash shows how quickly digital assets have become part of sanctions evasion. Regulators and exchanges are still catching up, and every major hack adds to the regime’s reserves.

The answer lies in tougher security at crypto platforms and quicker coordination when a theft happens. The faster stolen funds are traced and frozen, the less of it ever reaches Pyongyang.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.