North Korea Steals 58 Billion Won in Ethereum from Upbit... "Laundering by Converting to Bitcoin"

Hacking Groups Lazarus and Andariel Attacks
Traces of 'Heolhanil' Vocabulary Usage Found
Tracking Difficult Due to Lack of Cooperation from Overseas Exchanges

The National Police Agency's National Investigation Headquarters announced on the 21st that North Korea stole 342,000 Ethereum from the virtual asset exchange Upbit in November 2019. At the time of the theft, this was worth approximately 58 billion KRW, and its current value is about 1.47 trillion KRW.

Virtual Asset Theft Incident Attributed to North Korea. Photo by the National Police Agency

The hacking groups Lazarus and Andariel, under North Korea's Reconnaissance General Bureau, converted 57% of the stolen virtual assets into Bitcoin at a price 2.5% lower than the market rate through three virtual asset exchange sites they created. The remainder was laundered after being dispersed and transferred to 51 overseas exchanges. Records on information and communication devices showed traces of North Korean vocabulary, including the term ‘heolhanil’ (meaning unimportant matter).

During the investigation, the police discovered that some of the stolen virtual assets had been converted into Bitcoin and stored in a virtual asset exchange in Switzerland. They proved to the Swiss prosecution that these assets were part of those stolen from the Korean exchange and made efforts to recover the stolen assets through multiple video and phone conferences and visits to the Swiss Federal Prosecutor's Office. After nearly four years of criminal judicial cooperation between the Korean Prosecution Service and the Ministry of Justice, they recovered 4.8 Bitcoin (currently worth about 600 million KRW) from the exchange last month and returned it to Upbit.

Virtual Asset Exchange Site Created by North Korea. Provided by the National Police Agency

There have been several reports from the United Nations (UN) and foreign governments stating that North Korea uses virtual assets stolen through cyberattacks on virtual asset exchanges to fund nuclear and missile development. However, this is the first domestic case to reveal that cyberattacks on virtual asset exchanges were carried out by North Korea. The police shared the attack methods targeting virtual asset exchanges with the National Intelligence Service's National Cyber Crisis Management Team, the Financial Supervisory Service, the Financial Security Institute, the Korea Internet & Security Agency, the military, and virtual asset exchange officials.

A police official explained, “There are companies that specialize in mixing virtual assets, and if overseas exchanges refuse to cooperate, there is no way to force them,” adding, “Currently, the situation has changed so that we can no longer continue tracking, and the trail has gone cold.”