- Personal data of 258 victims stolen from six public and financial portals.
- BTS star Jungkook targeted in an attempted theft of HYBE shares worth 8.4 billion won.
- 21.3 billion won stolen in virtual assets; 12.8 billion won recovered by police.
South Korean authorities have dismantled an international hacking ring in one of the country’s largest cyber-fraud cases, revealing that nearly 39 billion won was stolen from high-profile victims.
The Seoul Metropolitan Police Agency confirmed the group exploited weak security on government, IT and financial platforms to steal data from 258 people. That information was subsequently used in extensive SIM-swap and account-takeover frauds.
The suspects targeted wealthy business executives, lawyers, athletes, cryptocurrency investors and celebrities, including BTS member Jungkook, who narrowly avoided the loss of HYBE shares valued at 8.4 billion won.
The investigation exposed a transnational operation spanning from Seoul to Bangkok.
Hackers exploited data from 258 victims
Between July 2023 and April 2024, the group breached six public and financial portals with inadequate security. The intrusions revealed personal data such as resident registration numbers and financial verification information.
Police said 258 victims were affected, including 75 corporate executives, 11 lawyers and officials, 12 celebrities, six athletes and 28 virtual-asset investors.
Collectively, the group accessed accounts holding an estimated 55.22 trillion won, with some individual accounts exceeding 12 trillion won.
To carry out the frauds, the hackers created 118 mobile accounts using the names of 89 victims. Those mobile accounts were used to circumvent security checks and siphon funds directly from bank and crypto wallets.
In total, 16 victims lost 39 billion won, while financial institutions blocked another 25 billion won during attempted thefts. The largest confirmed loss involved 21.3 billion won in virtual assets.
BTS star Jungkook targeted in 8.4 billion won attempt
The scheme drew widespread attention when police confirmed that BTS member Jungkook was among the intended victims.
Hackers attempted to transfer HYBE shares worth 8.4 billion won under his name, but the suspicious transaction was blocked before the funds left the account.
Officials credited banks and agencies for detecting abnormal activity and preventing potential losses for Jungkook. Rapid interventions—including account freezes and halted withdrawals—enabled police to recover 12.8 billion won.
Investigators warned the case exposed a serious weakness in South Korea’s passwordless authentication systems, which the group manipulated to carry out their operations.
Arrests in South Korea, China and Thailand
The investigation began in September 2023 after unauthorized mobile activations were first reported at Namdaemun police station. In the months that followed, 16 suspects were identified and detained.
Leaders, identified as Mr. A (35) and Mr. B (40), frequently moved between China and Thailand. Both were arrested in May in Bangkok after Seoul police coordinated with Thai authorities and Interpol.
Mr. A was extradited to South Korea on August 22 and faces 11 charges, including widespread fraud and hacking, while Mr. B remains in custody in Thailand pending extradition.
Three suspects remain detained in South Korea; others face prosecution for fraud, hacking and violations of the Information and Communications Network Act.
Police noted the outcome could have been far worse if the group had been allowed to continue operating.
Crypto-related frauds on the rise in South Korea
The case adds to a growing wave of crypto-linked cybercrime in South Korea. On May 15, police in Jeju arrested 25 suspects for running fake investment schemes that defrauded 48 people of 734 million won.
In a separate incident, a police officer in Incheon was accused of embezzling 700 million won from investors in a fake crypto project.
Meanwhile, Park “Jonbur Kim,” known as the “Coin King,” is on trial for manipulating the Artube token, which allegedly cost investors 68 billion won in losses.
Authorities are also investigating large-scale money laundering. Prosecutors allege unlicensed brokers routed 943.4 billion won through Neteller Pay from 2019 to 2024, earning 26 billion won in commissions.
Assets worth 4.4 billion won in Ethereum have since been seized from hidden wallets.
The cases extend to romance scams—one man in his 50s lost 100 million won in July—and celebrity-linked fraud, with actress Hwang Jung-eum facing trial over alleged embezzlement of 4.3 billion won from her agency for crypto purchases.
Despite these risks, South Korea remains one of the most active crypto markets in the world. Chainalysis data shows an inflow of $130 billion in 2024, with more than 10.8 million Koreans trading digital assets.
Over 10,000 investors hold balances above 1 billion won, particularly traders in their 20s. Regulators are preparing to approve the nation’s first spot crypto ETFs and a pegged stablecoin, while major exchanges expand custody services for institutional clients.