The Lazarus Group, which was accountable for the current $1.5 billion Bybit hack, now holds 13,518 BTC price $1.13 billion, in keeping with Arkham Intelligence.
This might make North Korea the fifth-largest nation-state to carry the asset behind the US, China, the UK, and Ukraine, in accordance to BitBO.
It could additionally make the cybercrime group’s holdings bigger than these of Bhutan and El Salvador, which maintain 13,029 BTC and 6,089 BTC, respectively.
Lazarus lately transformed a few of its stolen ETH into BTC, in keeping with Arkham.
BREAKING NEWS: North Korea’s Lazarus group has transformed the stolen $ETH to $BTC after the Bybit hack, now holding 13,562 $BTC price round $1.12B per information from @arkham. pic.twitter.com/DdNbcKd3oT
— Jason Ai. Williams (@GoingParabolic) March 17, 2025
Lazarus The Bitcoin Whale
Arkham additionally experiences that Lazarus-linked wallets maintain 13,702 ETH price round $26 million, 5,022 BNB price $3 million, $2.2 million in DAI, and a number of other stablecoins and wrapped crypto property.
“We grind and HODL simply so {that a} hacker group can steal over $1B in crypto. It’s time for us to take the market again,” commented crypto investor Kyle Chassé.
North Korea-linked actors have stolen over $6 billion in crypto property since 2017, with the proceeds reportedly spent on the nation’s ballistic missile program, reported Elliptic earlier this month.
On March 13, it deposited 400 ETH (ETH) price round $750,000 on the time into the Twister Money mixing service, in accordance to blockchain safety agency CertiK, which acknowledged, “The funds hint to the Lazarus group’s exercise on the Bitcoin community,” it famous.
Lazarus Group has additionally deployed six new malware packages to infiltrate developer environments, steal credentials, extract cryptocurrency information and set up backdoors, in keeping with analysis from cybersecurity agency Socket launched final week.
The malware dubbed “BeaverTail” is embedded in packages that mimic reputable JavaScript libraries and targets cryptocurrency wallets, particularly Solana and Exodus.
The researchers stated that “the techniques, strategies, and procedures noticed on this npm assault carefully align with Lazarus’s recognized operations.”
OKX Suspends DEX
In associated information, crypto change OKX suspended its Web3 decentralized change aggregator on March 17 following the detection of “a coordinated effort by Lazarus group to misuse our DeFi companies.”
Following the Bybit hack, OKX rolled out a hacker tackle detection system for its Web3 DEX aggregator and a system to trace the attacker’s newest addresses and block them within the CEX system in real-time.
Final week, Bloomberg reported that the OKX DEX aggregator was used to launder $100 million in crypto linked to Lazarus and the hack.
Binance Free $600 (CryptoPotato Unique): Use this hyperlink to register a brand new account and obtain $600 unique welcome supply on Binance (full particulars).
LIMITED OFFER for CryptoPotato readers at Bybit: Use this hyperlink to register and open a $500 FREE place on any coin!