South Korea confirms North Korea behind $50M Upbit hack

South Korean authorities confirmed that North Korean hackers were responsible for the $50 million Upbit cryptocurrency hack in 2019.

On Nov. 21, the country’s National Office of Investigation confirmed that the hack, which stole 342,000 Ether ETHUSD, was carried out by North Korean hacker groups Lazarus and Andariel. 

Upbit, a South Korea-based cryptocurrency exchange, reported on Nov. 27, 2019, that the crypto had been stolen from its hot wallet. The ETH was worth about $147 a coin at the time of the theft, making the total amount stolen about $50 million. 

With the recent surge in Ether’s value alongside Bitcoin BTCUSD, the stolen amount would exceed $1 billion today.

North Korean police confirm hack perpetrators after five years

South Korea’s Yonhap News reported that this marks the first time a South Korean investigative agency has officially confirmed North Korean involvement in a cryptocurrency hack.

The agency confirmed North Korea’s involvement by tracking crypto flows and IP addresses. They also analyzed the use of the North Korean language and information from the United States Federal Bureau of Investigation.

Although the police confirmed North Korea’s involvement, they withheld details about the hacking methods to prevent potential copycat attacks.

Since the breach, the attackers are believed to have sold about 57% of the stolen ETH on exchanges allegedly operated by North Koreans. The remaining funds were distributed and laundered through 51 overseas exchanges.

South Korea probes Upbit for KYC violations

The confirmation of North Korean involvement in the Upbit hack follows a recent probe into the crypto exchange. 

On Nov. 14, the Financial Intelligence Unit of South Korea’s Financial Services Commission found as many as 600,000 potential Know Your Customer violations by the crypto exchange. 

The FIU spotted alleged breaches while reviewing Upbit’s business license renewal. The exchange allegedly accepted blurred identification cards, which made it difficult for regulators to properly identify users. 

The violations may result in fines of up to $71,500 per case and complications in the exchange’s business license renewal.