South Korean authorities have successfully recovered 4.8 Bitcoin (BTC), which was linked to the 2019 hack of the Upbit exchange, local media outlet Yonhap News reported on Nov. 21.
The incident, in which North Korean hackers stole 342,000 Ethereum (ETH), was among the most significant cyberattacks targeting a cryptocurrency platform. The stolen Ethereum, valued at $41.4 million in 2019, is now worth over $1 billion at current prices.
The investigation
South Korea’s National Police Agency’s investigation confirmed the involvement of North Korean hacker groups Lazarus and Andariel in the Upbit 2019 hack. These groups are notorious for large-scale cybercrime and have stolen more than $3 billion in cryptocurrency from 2017 to 2023.
The confirmation marks the first time South Korean police have officially tied a significant hack to North Korean operatives.
Police explained that the hackers laundered 57% of the stolen ETH by converting it into Bitcoin. The funds flowed through three North Korea-linked exchanges and 51 global platforms.
After years of tracing blockchain activity and analyzing North Korean IP addresses, investigators identified patterns, including unique North Korean language usage. Support from the US Federal Bureau of Investigation (FBI) also contributed to uncovering the hackers’ operations.
The recovered Bitcoin, which was traced to a Swiss exchange, has been returned to Upbit.
Upbit scrutiny
This development arrives as Upbit is under scrutiny from South Korea’s Financial Intelligence Unit (FIU) over KYC-related violations. The FIU reports that the exchange could be implicated in as many as 600,000 compliance breaches.
South Korea’s Financial Services Commission (FSC) has also flagged concerns over Upbit’s market dominance. The exchange accounts for nearly 20% of the 22 trillion won deposited in K Bank, raising questions about potential risks to the financial system.
According to CoinMarketCap data, Upbit is the largest South Korean crypto trading platform, with a trading volume of around $6 billion.
Mentioned in this article
