- 258 victims’ personal data stolen from six public and financial portals.
- BTS star Jungkook targeted in an attempt to steal HYBE shares worth 8.4 billion won.
- 21.3 billion won in stolen virtual assets, 12.8 billion won recovered by police.
South Korean authorities have uncovered one of the country’s largest cyberfraud cases, dismantling an international hacking network that stole nearly 39 billion won from high-profile victims.
The Seoul Metropolitan Police Agency confirmed the group exploited weak security on government, IT and financial platforms to steal data from 258 people, which was later used in extensive SIM-swap frauds.
Suspects targeted wealthy business leaders, lawyers, athletes, crypto investors and celebrities, including BTS member Jungkook, who narrowly avoided a loss when an attempt was made to transfer HYBE shares worth 8.4 billion won under his name.
The investigation revealed the cross-border scope of the operation, extending from Seoul to Bangkok.
Hackers exploited data from 258 victims
From July 2023 to April 2024 the ring infiltrated six public and financial portals with weak protections. The breaches exposed personal data such as resident registration numbers and financial verification details.
Police said 258 victims were affected, including 75 corporate executives, 11 lawyers and officials, 12 celebrities, six athletes and 28 virtual asset investors.
The group collectively accessed accounts with a combined estimated value of 55.22 trillion won, with some individual accounts exceeding 12 trillion won.
To carry out the fraud, the hackers created 118 mobile accounts in the names of 89 victims. These accounts were then used to bypass security checks and siphon funds directly from bank and crypto wallets.
In total, 16 victims lost 39 billion won, while financial institutions managed to block an additional 25 billion won during attempted thefts. The largest confirmed loss included 21.3 billion won in virtual assets.
BTS star Jungkook targeted in 8.4 billion won attempt
The scheme attracted wide attention after police confirmed one intended victim was BTS member Jungkook.
Hackers attempted to transfer HYBE shares worth 8.4 billion won into his name, but the suspicious transaction was blocked before the assets left the account.
Officials credited banks and agencies for flagging abnormal activity, preventing potential losses for Jungkook. Overall, police recovered 12.8 billion won through swift measures including freezing accounts and stopping withdrawals.
Investigators emphasised the case exposed a critical weakness in South Korea’s non-face-to-face authentication systems, which the group manipulated during their operations.
Arrests in South Korea, China and Thailand
The probe began in September 2023 after reports were first filed at Namdaemun police station about unauthorised mobile activations. Over the following months, 16 suspects were identified and detained.
Leaders, identified only as Mr A (35) and Mr B (40), frequently moved between China and Thailand. Both were arrested in May in Bangkok after Seoul police cooperated with Thai authorities and Interpol.
Mr A was extradited to South Korea on August 22 and faces 11 charges including large-scale fraud and hacking, while Mr B remains in custody in Thailand awaiting extradition.
Three suspects remain detained in South Korea, while others face criminal charges for fraud, hacking and violating the Information and Communications Network Act.
Police noted the outcome could have been far worse if the group had been allowed to continue operating.
Crypto scams on the rise in South Korea
The case adds to a growing wave of crypto-related cybercrime in South Korea. On May 15 police in Jeju arrested 25 suspects for running fake investment schemes that defrauded 48 people of 734 million won.
In a separate incident, a police officer in Incheon was accused of embezzling 700 million won from investors in a fake crypto project.
Meanwhile, Park “Jonbur Kim,” known as the “Coin King,” is on trial over manipulation of the Artube coin, which caused investors losses of 68 billion won.
Authorities are also investigating large-scale money laundering. Prosecutors say unlicensed brokers routed 943.4 billion won through Neteller Pay from 2019 to 2024, earning 26 billion won in commissions.
Assets worth 4.4 billion won in Ethereum have since been seized from hidden wallets.
Cases have even extended to romance scams, with a man in his 50s losing 100 million won in July, and celebrity-linked fraud: actress Hwang Jung-eum faces trial over embezzling 4.3 billion won from her agency for cryptocurrency purchases.
Despite these risks, South Korea remains one of the most active crypto markets in the world. Data from Chainalysis shows an inflow of $130 billion in 2024, with more than 10.8 million Koreans trading digital assets.
Over 10,000 investors hold balances above 1 billion won, particularly traders in their 20s. Regulators are preparing to approve the country’s first spot crypto ETFs and a stablecoin tied to the won as major exchanges expand custody services for institutions.