- 258 victims’ personal data stolen from six public and financial portals.
- BTS star Jungkook targeted in an attempt to steal 8.4 billion won worth of HYBE shares.
- 21.3 billion won in virtual assets stolen; 12.8 billion won recovered by police.
South Korean authorities have uncovered one of the country’s largest cybercrime operations, dismantling an international hacking ring that stole nearly 39 billion won from high-profile victims.
The Seoul Metropolitan Police Agency confirmed the group exploited weak security on government, technology and financial platforms to harvest data on 258 people, which was then used in large-scale SIM swap fraud.
The suspects targeted wealthy business owners, lawyers, athletes, cryptocurrency investors and celebrities, including BTS member Jungkook, who narrowly avoided a loss of 8.4 billion won in HYBE shares.
Investigations revealed the operation had cross-border reach, extending from Seoul to Bangkok.
Hackers exploited data from 258 victims
Between July 2023 and April 2024, the ring breached six public and financial portals with inadequate protections. The intrusions exposed personal details such as resident registration numbers and financial verification data.
Police say 258 victims were affected, including 75 corporate executives, 11 lawyers and government officials, 12 celebrities, six athletes and 28 virtual asset investors.
Collectively, the group accessed accounts holding an estimated combined 55.22 trillion won in assets, with some individual accounts exceeding 12 trillion won.
To carry out the fraud, the hackers created 118 mobile accounts in the names of 89 victims. Those accounts were used to bypass security checks and withdraw funds directly from bank and crypto wallets.
In total, 16 victims lost 39 billion won, while financial institutions blocked an additional 25 billion won in attempted thefts. The largest confirmed loss involved 21.3 billion won in virtual assets.
BTS star Jungkook targeted in an 8.4 billion won attempt
The scheme drew widespread attention after police confirmed BTS member Jungkook was among the targeted victims.
Hackers attempted to transfer 8.4 billion won worth of HYBE shares under his name, but the suspicious transaction was frozen before funds left the account.
Officials credited banks and agencies for detecting the unusual activity, preventing the potential loss. Overall, police recovered 12.8 billion won through swift interventions, including account freezes and halting withdrawals.
Investigators emphasized the case revealed a critical weakness in South Korea’s non–face-to-face authentication systems, which the group exploited to carry out its operations.
Arrests in South Korea, China and Thailand
The probe began in September 2023 after unauthorized mobile activations were first reported to Namdaemun Police Station. In the following months, 16 suspects were identified and arrested.
The leaders, identified only as Mr. A (35) and Mr. B (40), frequently moved between China and Thailand. Both were arrested in Bangkok in May following cooperation between Seoul police, Thai authorities and Interpol.
Mr. A was extradited to South Korea on August 22 and faces 11 charges, including large-scale fraud and hacking, while Mr. B remains in custody in Thailand awaiting extradition.
Three suspects are detained in South Korea, while others face criminal proceedings for fraud, hacking and violations of the Information and Communications Network Act.
Police said the outcome could have been far worse if the group had been allowed to continue operating.
Rising crypto-related scams in South Korea
The case adds to a growing wave of cybercrimes tied to cryptocurrencies in South Korea. On May 15, Jeju police arrested 25 suspects who ran fake investment schemes that defrauded 48 people of 734 million won.
In another incident, an Incheon police officer was accused of embezzling 700 million won from investors in a bogus crypto project.
Meanwhile, Park “Jonbur Kim,” known as the “Coin King,” is on trial for manipulating the Artube token, which led to investor losses of 68 billion won.
Authorities are also probing large-scale money laundering. Prosecutors say unlicensed brokers routed 943.4 billion won through Neteller Pay between 2019 and 2024, earning 26 billion won in fees.
Assets worth 4.4 billion won in Ethereum have since been seized from hidden wallets.
The scams have also included romance fraud—one man in his 50s lost 100 million won in July—and celebrity-related fraud, with actress Hwang Jung-eum facing trial over alleged embezzlement of 4.3 billion won from her agency for cryptocurrency purchases.
Despite these risks, South Korea remains one of the world’s most active crypto markets. Chainalysis data showed inflows of $130 billion in 2024, with more than 10.8 million Koreans trading digital assets.
Over 10,000 investors hold balances exceeding 1 billion won, particularly among traders in their 20s. Regulators are preparing to approve the nation’s first spot crypto ETFs and a won-pegged stablecoin, while major exchanges expand custody services for institutions.