South Korean Police Confirm 300K+ ETH Crypto Theft After Five Years

Highlights:

• South Korean police have confirmed an over 300K ETH crypto theft years after the malicious actors pulled the heist.
• The law enforcement agency implicated some North Korean entities in the cybercrime.
• After five years, the police succeeded in recovering only 4.8 BTC from a Swiss exchange.

In news circulating, South Korean police have finally identified the perpetrators of a cyber heist involving the theft of over 300K Ethereum (ETH). A news publication outlet domiciled in the Asian nation published the news in the early hours of today.

According to the report, the police confirmed the incident five years after Upbit suffered a cyber theft that saw it forfeit 342,000 ETH in 2019. In its investigational report, the National Investigation Headquarters of the National Police Agency linked the cyber incidents to North Korean entities.

Contrary to usual practices, the South Korean enforcement agency did not reveal the specific scam method. Per the police, such information could be counterproductive as other offenders might want to pounce on the strategy.

Meanwhile, as of 2019, the 300K+ Ethereum cost approximately 58 billion won ($41,493,333.40). Based on current market standings, the stolen assets have soared considerably in market worth. Their valuation spiked to roughly 1.47 trillion won ($1,051,772,988.63).

[🌲] South Korea Confirms North Korea Stole $42m Ether From Upbit: Yonhap

— Tree News (@News_Of_Alpha) November 21, 2024

Malicious Actors Succeeded in Laundering Most of the Stolen Assets

Per the police statement, the North Korean scammers exchanged roughly 57% of the stolen ETH tokens for Bitcoin (BTC). Notedly, the exchange occurred at rates 2% below BTC’s market price as of the time of bargaining the transaction.

The police also noted that three local North Korean trading platforms facilitated the conversion of ETH to BTC. In addition, the cybercriminals laundered the remaining stolen crypto assets by sending them to about 51 overseas exchanges.

Digital Assets Recovery Efforts

Considering the manner of cryptocurrency laundering described above, one could assert that recovery might seem tricky. However, the law enforcement agency has proven dependable with concentrated efforts to recover a portion of the stolen assets.

In its report, the police noted that it tracked some of the converted ETH to BTC assets in a Swiss exchange. Consequently, the law enforcement agency proved to the Switzerland-based trading outlet that Upbit owned some of the digital assets under its care.

South Korean police confirmed for the first time that 342,000 ETH was stolen from Upbit, South Korea's largest exchange, in 2019 by North Korean official hacker groups Lazarus and Andariel. 57% of ETH was exchanged for Bitcoin at a low price, and the rest of the assets were…

— Wu Blockchain (@WuBlockchain) November 21, 2024

The police’s persistence eventually paid off when the Swiss trading platform recovered 4.8 BTC from the perpetrator’s wallet address and returned them to Upbit in October. At the time of retrieving and sending the Bitcoin tokens cost approximately 600 million won ($429,067.92). Relative to the original amount stolen in 2019, the recovered sum represented merely 1%. of the forfeited 58 Billion won.

Investigational Evidence Linking North Korean Entities to Cyber Theft

Aside from spotting North Korean exchanges’ involvement in the laundering processes, the police revealed several other leads linking North Korean entities to cybercrime. The law enforcement agency noted even before investigations, it had received reports from the United Nations (UN) and other foreign bodies calling out North Koreans’ role in digital assets theft.

However, it has finally confirmed a similar scenario in South Korea. In its report, the police stated that hacker groups Lazarus and Andariel masterminded the over 300K ETH cyber heist. Both companies share a strong affiliation with the North Korean Reconnaissance General Bureau.

In addition, the South Korean police mentioned they assessed several other significant pieces of information to confirm their claims. The investigational confirmatory sources include North Korea’s IP addresses, Northern Korean slang, digital assets flow patterns, and investigational inputs from the Federal Bureau of Investigation (FBI).

For context, the police mentioned that they spotted North Korean vocabulary like “Heulhan Il” on the computer the hackers used to perpetuate the malicious act. Heulhan Il, in a literal sense, signifies something of little or no importance.