South Korean authorities have identified North Korean hacker groups Lazarus and Andariel as responsible for the $50 million Upbit cryptocurrency hack in 2019.
The stolen Ethereum, initially worth 58 billion won, has surged to around 1.47 trillion won due to rising crypto prices.
On November 21, the National Investigation Headquarters of the National Police Agency revealed that the hackers, linked to North Korea’s Reconnaissance General Bureau, stole 342,000 Ethereum (ETH) from the South Korean exchange Upbit in November 2019.
According to South Korea Yonhap News, this marks the first time a South Korean investigative body has officially attributed a cryptocurrency heist to North Korean operatives. The investigation combined data from North Korean IP addresses, cryptocurrency flow tracking, traces of North Korean language usage, and collaboration with the U.S. FBI. Notably, investigators discovered the term “Heulhan Il,” meaning “not important,” on a computer used in the attack, a linguistic clue tied to North Korea.
Authorities confirmed that 57% of stolen Ethereum was sold at a 2.5% discount on three North Korean-operated exchanges, while the rest was laundered through 51 overseas exchanges. Some stolen Ethereum was converted to Bitcoin and stored in a Swiss exchange. After four years of legal proceedings, South Korean authorities recovered 4.8 Bitcoin, valued at about 600 million won, which was returned to Upbit in October 2024.
Police have withheld details of the hacking methods to prevent potential copycat crimes but emphasize the unprecedented scale and sophistication of the North Korean operation.
Meanwhile, South Korea’s Financial Intelligence Unit (FIU) is reviewing Upbit’s operations for alleged non-compliance with KYC requirements. Reports indicate the exchange may have failed to verify customer identities in 500,000 to 600,000 cases, including issues with identification documents and incomplete details. These lapses could lead to regulatory penalties under the Special Financial Transaction Information Act if confirmed.
If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
