The Lazarus Group, which was responsible for the recent $1.5 billion Bybit hack, now holds 13,518 BTC worth $1.13 billion, according to Arkham Intelligence.<\/p>\n
This could make North Korea the fifth-largest nation-state to hold the asset behind the United States, China, the United Kingdom, and Ukraine, according<\/a> to BitBO.<\/p>\n It would also make the cybercrime group\u2019s holdings larger than those of Bhutan and El Salvador, which hold 13,029 BTC and 6,089 BTC, respectively.<\/p>\n Lazarus recently converted some of its stolen ETH into BTC, according to Arkham.<\/p>\n BREAKING NEWS: North Korea\u2019s Lazarus group has converted the stolen $ETH<\/a> to $BTC<\/a> after the Bybit hack, now holding 13,562 $BTC<\/a> worth around $1.12B per data from @arkham<\/a>. pic.twitter.com\/DdNbcKd3oT<\/a><\/p>\n \u2014 Jason Ai. Williams (@GoingParabolic) March 17, 2025<\/a><\/p>\n\n Arkham also reports<\/a> that Lazarus-linked wallets hold 13,702 ETH worth around $26 million, 5,022 BNB worth $3 million, $2.2 million in DAI, and several stablecoins and wrapped crypto assets.<\/p>\n \u201cWe grind and HODL just so that a hacker group can steal over $1B in crypto. It\u2019s time for us to take the market back,\u201d commented<\/a> crypto investor Kyle Chass\u00e9.<\/p>\n North Korea-linked actors have stolen<\/a> over $6 billion in crypto assets since 2017, with the proceeds reportedly spent on the country\u2019s ballistic missile program, reported<\/a> Elliptic earlier this month.<\/p>\n On March 13, it deposited 400 ETH (ETH) worth around $750,000 at the time into the Tornado Cash mixing service, according<\/a> to blockchain security firm CertiK, which stated, \u201cThe funds trace to the Lazarus group\u2019s activity on the Bitcoin network,\u201d it noted.<\/p>\n Lazarus Group has also deployed six new malware packages to infiltrate developer environments, steal credentials, extract cryptocurrency data and install backdoors, according to research from cybersecurity firm Socket released<\/a> last week.<\/p>\n The malware dubbed \u201cBeaverTail\u201d is embedded in packages that mimic legitimate JavaScript libraries and targets cryptocurrency wallets, specifically Solana and Exodus.<\/p>\n The researchers said that \u201cthe tactics, techniques, and procedures observed in this npm attack closely align with Lazarus\u2019s known operations.\u201d<\/p>\n In related news, crypto exchange OKX suspended its Web3 decentralized exchange aggregator on March 17 following the detection of \u201ca coordinated effort by Lazarus group to misuse our DeFi services.\u201d<\/p>\n Following the Bybit hack<\/a>, OKX rolled out a hacker address detection system for its Web3 DEX aggregator and a system to track the attacker\u2019s latest addresses and block them in the CEX system in real-time.<\/p>\n Last week, Bloomberg reported<\/a> that the OKX DEX aggregator was used to launder $100 million in crypto linked to Lazarus and the hack.<\/p>\n The post Lazarus Group Becomes $1B Bitcoin Whale After Converting: Arkham<\/a> appeared first on CryptoPotato<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" The Lazarus Group, which was responsible for the recent $1.5 billion Bybit hack, now holds 13,518 BTC worth $1.13 billion, according to Arkham Intelligence. This could make North Korea the fifth-largest nation-state to hold the asset behind the United States, China, the United Kingdom, and Ukraine, according to BitBO. It would also make the cybercrime […]<\/p>\n","protected":false},"author":0,"featured_media":52307,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-52306","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/52306"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=52306"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/52306\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/52307"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=52306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=52306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=52306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Lazarus The Bitcoin Whale<\/h2>\n
OKX Suspends DEX<\/h2>\n