- Personal data of 258 victims were stolen from six public and financial portals.
- BTS star Jungkook narrowly avoided a theft attempt of HYBE shares worth 8.4 billion won.
- 21.3 billion won in stolen virtual assets; 12.8 billion won recovered by police.
South Korean authorities have uncovered one of the country’s largest cyber fraud operations, dismantling an international hacking ring that stole nearly 39 billion won from high-profile victims.
The Seoul Metropolitan Police Agency confirmed that the group exploited weak security on government, IT and financial platforms to steal data from 258 people, which was later used in large-scale SIM-swap fraud.
Suspects targeted wealthy business leaders, lawyers, athletes, crypto investors and celebrities, including BTS member Jungkook, who narrowly avoided losing HYBE shares valued at 8.4 billion won.
The investigation revealed the cross-border scope of the operation, which reached from Seoul to Bangkok.
Hackers exploited data from 258 victims
Between July 2023 and April 2024 the ring infiltrated six public and financial portals that had weak protections. The breaches exposed personal information such as resident registration numbers and financial verification data.
Police said 258 victims were affected, including 75 business executives, 11 lawyers and officials, 12 celebrities, six athletes and 28 virtual asset investors.
Overall, the group accessed accounts with an estimated combined balance of 55.22 trillion won, with some individual accounts holding more than 12 trillion won.
To carry out the fraud, the hackers created 118 mobile accounts under the names of 89 victims. Those accounts were then used to bypass security checks and siphon funds directly from banks and crypto wallets.
In total, 16 victims lost 39 billion won, while financial institutions were able to block an additional 25 billion won in attempted thefts. The largest confirmed loss involved 21.3 billion won in virtual assets.
BTS star Jungkook targeted in 8.4 billion won attempt
The case drew wide attention after police confirmed that BTS member Jungkook was among the intended victims.
Hackers attempted to move HYBE shares worth 8.4 billion won under his name, but the suspicious transfer was blocked before funds left the account.
Officials credited banks and agencies with detecting abnormal activity and preventing potential losses to Jungkook. Through rapid intervention—freezing accounts and halting withdrawals—police recovered 12.8 billion won.
Investigators warned, however, that the case exposed critical weaknesses in South Korea’s authentication systems that the group had exploited for their operations.
Arrests in South Korea, China and Thailand
The investigation began in September 2023 after Namdaemun police station received initial reports of unauthorized mobile activations. Over the following months, authorities identified and arrested 16 suspects.
The ringleaders, identified only as Mr. A (35) and Mr. B (40), frequently moved between China and Thailand. Both were arrested in Bangkok in May after Seoul police coordinated with Thai authorities and Interpol.
Mr. A was extradited to South Korea on August 22 and faces 11 charges, including large-scale fraud and hacking, while Mr. B remains detained in Thailand pending extradition.
Three suspects remain in custody in South Korea, and others are being prosecuted on charges of fraud, hacking and violations of the Information and Communications Network Act.
Police noted the outcome could have been far worse if the ring had been allowed to continue its operations.
Crypto fraud on the rise in South Korea
The case is part of a rising wave of cryptocurrency-related cybercrime in South Korea. On May 15, Jeju police arrested 25 suspects for running fake investment programs that defrauded 48 people of 734 million won.
In another incident, a police officer in Incheon was charged with embezzling 700 million won from investors in a fake crypto project.
Meanwhile, Park “Jonbur Kim,” known as the “coin king,” faces trial over manipulation of the Artube coin, which caused investors losses of 68 billion won.
Authorities are also probing large-scale money laundering. Prosecutors say unlicensed brokers moved 943.4 billion won through Neteller Pay between 2019 and 2024 and earned 26 billion won in commissions.
Assets worth 4.4 billion won in Ethereum have since been seized from hidden wallets.
These cases have even extended to romance scams—a man in his 50s lost 100 million won in July—and celebrity-related fraud, with actress Hwang Jung-eum accused of embezzling 4.3 billion won from her agency for crypto purchases.
Despite these risks, South Korea remains one of the world’s most active crypto markets. Chainalysis data show inflows of $130 billion in 2024 and more than 10.8 million Koreans trading digital assets.
Over 10,000 investors hold balances exceeding 1 billion won, particularly among traders in their 20s. Regulators are now preparing to approve the country’s first spot crypto ETFs and a won-pegged stablecoin, while major exchanges expand custody services for institutional clients.