South Korean Police Confirm Lazarus Group Behind 342,000 ETH Upbit Hack

South Korean police confirmed that North Korean hacker Lazarus group and Andariel orchestrated the 2019 theft of 342,000 Ethereum (ETH) from Upbit, South Korea’s largest cryptocurrency exchange. This is the first time authorities have officially acknowledged North Korea’s involvement in a domestic exchange hack.

The stolen assets, worth 1.4 trillion won at the current price, flowed through multiple exchanges worldwide. Despite the theft’s massive scale, only a small portion was recovered. Specifically, 4.8 Bitcoins were retrieved from a Swiss exchange.

Lazarus and Andariel Steal 342,000 ETH From Upbit

Lazarus and Andariel, North Korea’s notorious hacker groups, carried out the 2019 theft of 342,000 ETH from Upbit, South Korean police confirmed. The stolen Ethereum, valued at over 1.4 trillion won (approximately $1 billion), was carefully laundered. According to yna.co report, 57% of the stolen ETH was exchanged for Bitcoin at a 2.5% discount on three exchange sites, likely created by North Korea. Meanwhile, the remaining cryptocurrency flowed through 51 exchanges across 13 countries, including major players in the US and China.

South Korean authorities worked closely with the US FBI and other international agencies to track the stolen assets. Despite many laundered funds being spread across foreign exchanges, the investigation led to a significant recovery. After presenting evidence to Swiss authorities, they successfully recovered 4.8 Bitcoin, worth 600 million won, and returned it to Upbit. This marked a rare instance of recovering stolen funds.

This theft highlights North Korea’s increasing reliance on cryptocurrency hacks to fund its activities. The Lazarus Group has led North Korea in carrying out multiple high-profile cyberattacks on top crypto exchanges.

Besides, this report also highlights the growing hacks and scam incidents in the crypto space. For context, the US DOJ has charged five hackers recently for stealing $6.3 million in digital assets.

North Korea’s Long History of Crypto Thefts and Global Impact

The Lazarus Group operates as a North Korean state-sponsored cybercrime organization. It carries out sophisticated hacks targeting financial institutions and crypto exchanges globally. The group’s operations focus on stealing high-value assets, especially cryptocurrency.

Recently, investigators linked Lazarus to the $238 million Bitcoin theft in August 2023. During this attack, the funds moved across several platforms. Speculation surrounding the group’s involvement intensified, as experts analyzed the suspicious transactions.