The South Korean cryptocurrency exchange Upbit was hacked by North Korean hackers, who stole 342,000 ETH (equivalent to $50 million in 2019, now worth over $1 billion).
The National Intelligence Agency (NIA) of South Korea officially confirmed on November 21 the involvement of the North Korean hacker groups Lazarus and Andariel in the cyber attack targeting the Upbit cryptocurrency exchange in 2019.
The incident, which occurred on November 27, 2019, resulted in Upbit losing 342,000 Ether (ETH) from its hot wallet. At the time, the value of the stolen ETH was approximately $50 million, based on the price of $147 per ETH. However, with the strong growth of the cryptocurrency market in recent years, the value of this ETH has now exceeded $1 billion.
Details of the attack and money laundering activities
This is the first time a South Korean investigative agency has officially identified North Korea as being behind a cryptocurrency attack. The NIA reached this conclusion based on tracing the flow of the cryptocurrency, analyzing IP addresses, identifying North Korea's distinctive language patterns, and information shared by the U.S. Federal Bureau of Investigation (FBI). The details of the attack method were not disclosed to avoid setting a precedent for similar attacks.
According to the report, the hackers sold approximately 57% of the stolen ETH through exchanges believed to be controlled by North Korea. The remaining 43% of the ETH was dispersed and laundered through 51 different international exchanges. This behavior demonstrates the sophistication of the hacker groups' money laundering activities, aimed at concealing the illegal origin of the cryptocurrency.
It is noteworthy that the incident occurred while Upbit was facing an investigation into its "Know Your Customer" (KYC) compliance practices. On November 14, the Financial Intelligence Unit (FIU) of the Financial Services Commission of South Korea discovered more than 600,000 potential violations related to Upbit's KYC policies. Specifically, the exchange was accused of accepting blurred personal documents, making it difficult to verify user identities. Each violation can be fined up to $71,500 and could impact Upbit's license renewal process.
