Edit: Upbit hack — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **On attribution:** The North Korea attribution is that of South Korea's National Police Agency (announced Nov 2024), supported by the FBI; cyber-attribution is rarely 100% certain.

## Summary

On November 27, 2019, about 342,000 ether — worth roughly 58 billion won (~$41.5 million) at the time — was abnormally transferred out of the South Korean cryptocurrency exchange Upbit. [1][2]

## Attribution

In November 2024, South Korea's National Police Agency announced that North Korea's state-sponsored Lazarus and Andariel groups (both under the Reconnaissance General Bureau) carried out the theft. Police said they reached the conclusion using North Korean IP addresses, cryptocurrency flow analysis, traces of North Korean vocabulary, and material obtained with the FBI's help. It was the first time a South Korean agency officially attributed a crypto-exchange hack to North Korea. [1][2]

## Laundering and partial recovery

Police said about 57% of the stolen ether was swapped for bitcoin at a slight discount through three exchange sites believed to have been set up by North Korea, with the remainder distributed across 51 overseas exchanges. After a multi-year legal process, roughly 4.8 BTC was recovered from a Swiss exchange and returned to Upbit. [1][2]

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit