North Korea Stole 342,000 Ethereum (ETH) from Upbit in 2019, South Korea Confirms

As a seasoned crypto investor with over a decade of experience navigating the digital asset market, I can’t help but feel a mix of frustration and concern upon reading about North Korea’s involvement in the 2019 Upbit hack. Having lost some of my own hard-earned investments to cybercrimes in the past, I understand the gut-wrenching feeling that comes with seeing your digital assets being stolen by malicious actors.


As an analyst, I can confirm that recent reports suggest North Korea as the culprit behind the theft of 342,000 Ethereum tokens in 2019. This substantial amount, approximately equivalent to 58 billion Won or $41.5 million, was stolen from the Upbit cryptocurrency exchange.

One large-scale cryptocurrency theft worth approximately 1.47 trillion Won is believed to be connected with North Korea, making it one of the biggest such heists on record.

North Korea’s Involvement Uncovered

According to the latest report, it was revealed on November 21st that two hacking teams, Lazarus and Andariel, who are connected to North Korea’s Reconnaissance General Bureau (a government body associated with cyber espionage and financial crimes), were behind a recent cyber attack.

As a researcher delving into this investigation, I leveraged a blend of digital forensic techniques such as tracing IP addresses and monitoring the trajectory of misappropriated cryptocurrencies. Moreover, my findings were augmented by the detection of linguistic footprints suggestive of North Korean dialect.

It emerged that during the cyber-attack, there were signs of the phrase ‘Heulhan Il’ – which means ‘unimportant matter’ in English – on the computer being used at the time. This finding was subsequently confirmed by other local Korean news outlets.

The distinctive linguistic mark, combined with further technological proof, significantly bolstered the accusation against North Korea, as stated in the report. Additionally, the United States Federal Bureau of Investigation (FBI) law enforcement also contributed to the probe. They offered supplementary evidence suggesting that the attack was indeed orchestrated by North Korea.

After the robbery, the offenders converted approximately 57% of the stolen Ethereum into Bitcoin on three suspected North Korean-operated cryptocurrency platforms. This conversion took place at prices that were 2.5% lower than market value, likely to hasten the sale process. The rest of the Ethereum was hidden by laundering it across 51 international exchanges and masking its original source.

In 2020, some of the stolen cryptocurrency was traced back to a Swiss crypto exchange. After a four-year investigation to establish its origin for Swiss law enforcement, South Korean officials managed to retrieve approximately 4.8 Bitcoin (BTC), worth roughly 600 million won, in 2024. These funds were then returned to Upbit in October of that year.

Concerns Over North Korea and Upbit Woes

As an analyst, I’ve observed that North Korea’s involvement in cryptocurrency-related crimes isn’t novel. Over time, it seems they’ve adapted their strategies. Recently, as BeInCrypto reported, hackers associated with this regime have been focusing more on targeting crypto firms using advanced tactics. Some of the common techniques they employ include phishing attempts and supply chain attacks.

A recent report reveals that the ‘Hidden Risk’ campaign, as we called it, sends out false news articles about cryptocurrency movements to trick victims into downloading a harmful software hidden within a PDF document posing as a legitimate one.

This shift in strategy underscores the need for increased vigilance in cybersecurity throughout our sector. Moreover, the revelation that North Korea played a role in the 2019 Upbit hack signals a major turning point.

For the first time, South Korean officials have publicly connected North Korea’s government to a significant cryptocurrency robbery, which underscores the twin risks that the crypto industry faces.

Initially, potential dangers originating from state-backed hackers, and secondly, vulnerabilities stemming from insufficient adherence to regulatory guidelines. In addressing the latter issue, as BeInCrypto has reported, the Financial Intelligence Unit of South Korea has expressed concerns about inadequate user verification systems. More specifically, they have highlighted approximately 600,000 potential Know Your Customer (KYC) breaches at Upbit, South Korea’s largest cryptocurrency exchange.

The finding of significant Know Your Customer (KYC) breaches at Upbit spark debate over whether cryptocurrency exchanges are taking adequate steps to prevent unlawful activities. Enhanced monitoring, coupled with rigorous application of anti-money laundering (AML) regulations, could potentially discourage future incidents and create a more secure trading atmosphere for investors.

Additionally, the platform is under scrutiny by South Korea’s Fair Trade Commission for suspected misuse of its dominant position in the market. They are investigating potential violations of antitrust laws.

Read More

2024-11-21 13:08