Police Extradite and Detain Foreign Hacker Who Stole 1.7 Billion Won in Virtual Assets

Malware Distributed Worldwide

The National Office of Investigation under the Korean National Police Agency announced on December 28 that it had extradited and detained a foreign hacker who distributed malware that changed virtual asset receiving addresses and stole virtual assets worth approximately 1.7 billion won.

The suspect, identified as A (29, Lithuanian national), distributed malware disguised as an illegal Windows license activation program 2.8 million times worldwide between April 2020 and January 2023. As a result, the malware infected 3,100 virtual asset address users and, through 8,400 incidents, stole virtual assets worth approximately 1.7 billion won. Eight Korean victims suffered losses totaling about 16 million won.

The police launched an investigation in August 2020 after receiving a report stating, "I transferred one Bitcoin (worth about 12 million won at the time), but it was sent to the wrong address and lost."

Through a year-long collaboration with the Lithuanian Ministry of Justice and police, Korean authorities were able to conduct a compulsory investigation into suspect A. In early December last year, in cooperation with the Ministry of Justice and the Prosecutors' Office, Korean authorities and Lithuanian officials jointly raided A's residence, seizing a total of 22 items, including a mobile phone and a laptop.

A was arrested while entering Georgia from Lithuania. The Korean police, Ministry of Justice, and Prosecutors' Office closely cooperated and requested the extradition of the suspect from Georgia.

An official from the Korean National Police Agency stated, "Going forward, the police will continue to respond strictly to borderless cybercrimes by cooperating with law enforcement agencies worldwide, including through extradition."