Upbit hack
In November 2019, 342,000 ETH (~$41.5M at the time) was stolen from South Korean exchange Upbit. In November 2024 South Korea's National Police Agency officially attributed the theft to North Korea's Lazarus and Andariel groups — its first such attribution of an exchange hack.
Also known as: Upbit hack, Upbit Ethereum theft
On attribution: The North Korea attribution is that of South Korea's National Police Agency (announced Nov 2024), supported by the FBI; cyber-attribution is rarely 100% certain.
Summary
On November 27, 2019, about 342,000 ether — worth roughly 58 billion won (~$41.5 million) at the time — was abnormally transferred out of the South Korean cryptocurrency exchange Upbit. [1][2]
Attribution
In November 2024, South Korea's National Police Agency announced that North Korea's state-sponsored Lazarus and Andariel groups (both under the Reconnaissance General Bureau) carried out the theft. Police said they reached the conclusion using North Korean IP addresses, cryptocurrency flow analysis, traces of North Korean vocabulary, and material obtained with the FBI's help. It was the first time a South Korean agency officially attributed a crypto-exchange hack to North Korea. [1][2]
Laundering and partial recovery
Police said about 57% of the stolen ether was swapped for bitcoin at a slight discount through three exchange sites believed to have been set up by North Korea, with the remainder distributed across 51 overseas exchanges. After a multi-year legal process, roughly 4.8 BTC was recovered from a Swiss exchange and returned to Upbit. [1][2]
Bracketed numbers refer to the numbered sources listed below.
People & entities involved
- Lazarus GroupAttributed actorOrganizations & groupsThe most widely used name for North Korea's state-sponsored hacking apparatus, run under its Reconnaissance General Bureau. Blamed for the Sony hack, the Bangladesh Bank SWIFT heist, WannaCry, and — since ~2017 — many of the largest crypto thefts ever. Chainalysis puts DPRK's cumulative crypto haul near $6.75B, used to fund the regime's weapons programs.
- AndarielAttributed actorOrganizations & groupsA North Korea-linked RGB unit (Lazarus umbrella) that blends cyber-espionage with revenue generation. The U.S. sanctioned it in 2019 and, in 2024, indicted member Rim Jong Hyok for deploying Maui ransomware against U.S. hospitals and laundering the proceeds to fund further espionage.
Sources (2)
- S. Korea confirms N. Korea stole 58 bln won worth of cryptocurrency in 2019 — Yonhap News Agency
- North Korea confirmed perpetrator of 2019 Upbit crypto theft — Korea JoongAng Daily
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
