Yonhap News Agency reported that the South Korean police have confirmed that the 2019 hacking of 58 billion won is related to North Korean hackers.
On November 21, Yonhap News Agency reported that the South Korean police have officially confirmed for the first time that the theft of 342,000 ETH (worth about 58 billion won in 2019 and currently about 1.47 trillion won) from the cryptocurrency exchange Upbit was carried out by a group of North Korean hackers. The Lazarus and Andariel hacker groups, which belong to the North Korean General Reconnaissance Bureau, were identified as being involved in this attack. The conclusion was drawn based on evidence from North Korean IP addresses, the flow of cryptocurrency assets, traces of the use of North Korean-specific language, and information gathered through cooperation with the U.S. FBI.
Most of the stolen ETH, accounting for 57%, was converted to BIT at a 2.5% lower market price through three suspected money laundering platforms established by North Korea. The remaining assets were dispersed across 51 international exchanges to conceal the origin. In 2020, the police discovered a portion of the assets in the form of BIT stored on an exchange in Switzerland. After four years of investigation, in October this year, the police successfully recovered 4.8 BIT, worth about 600 million won, and returned it to Upbit.
