- Trending
- Comments
- Latest
North Korea’s state-sponsored hacking group Lazarus is suspected of stealing approximately $30.6 million in cryptocurrency from Upbit, South Korea’s largest digital asset exchange, in a breach that authorities say bears the hallmarks of previous attacks attributed to the regime’s cybercrime operations.
The hack, discovered Thursday, involved the unauthorized transfer of Solana-linked assets worth 44.5 billion won ($31.3 million) to an external wallet, according to Upbit’s operator Dunamu. The company said it will fully reimburse affected users from its own reserves and has temporarily suspended all withdrawals and deposits while the investigation proceeds.
South Korean authorities are preparing to conduct an on-site inspection at the exchange after preliminary analysis suggested the attack methods closely resembled techniques used in a 2019 breach when hackers allegedly stole 58 billion won ($41 million) in Ethereum from the same platform, Yonhap News reported citing government and industry sources.
Security officials said the stolen funds were quickly moved through wallets associated with other platforms in an apparent attempt to obscure the transaction trail, a tactic Lazarus has employed in previous operations.
“It is their standard approach to scatter tokens across multiple networks to break tracking,” one official told Yonhap.
Investigators believe the attackers may have bypassed core infrastructure by impersonating administrators or compromising internal accounts to authorize the withdrawal.
The breach demonstrates the sophisticated social engineering and technical capabilities attributed to Lazarus, which has been linked to multiple high-profile cryptocurrency thefts aimed at generating revenue for Pyongyang amid persistent foreign currency shortages.
Analysts noted that Lazarus has repeatedly targeted prominent crypto platforms to maximize impact and exposure, suggesting the attack may have been deliberately timed to exploit heightened public attention following Wednesday’s announcement that internet giant Naver would acquire Dunamu through a share-swap deal via its finance arm.
The breach comes as South Korea reconsiders its sanctions approach toward North Korea following new US measures that connected Pyongyang’s crypto theft operations to funding for its weapons programs.
Second Vice Foreign Minister Kim Ji-na said earlier this month that Seoul could “review sanctions as a measure if they are really needed,” emphasizing close coordination with Washington to counter North Korea‘s expanding cyber and digital threats.
“In cases of cryptocurrency theft by Pyongyang, coordination between South Korea and the US is important, as it can be used to fund North Korea’s nuclear and missile programs and pose a threat to our digital ecosystem,” Kim stated.
North Korean state-sponsored hackers have stolen billions of dollars in cryptocurrency over the past decade, with UN sanctions monitors and US authorities identifying the funds as a critical revenue source for the regime’s nuclear and ballistic missile development programs.
The attack occurred just one day after Naver announced plans to acquire Dunamu, placing the exchange under intense public and regulatory scrutiny. The timing has prompted questions about whether hackers deliberately targeted the platform to capitalize on the attention surrounding the deal.
Naver Financial, the fintech arm of Naver, is separately preparing to launch a stablecoin wallet in Busan next month as part of the city’s initiative to build a blockchain-powered local economy. The project is being developed in partnership with venture capital firm Hashed and the Busan Digital Asset Exchange.
Dunamu said it is cooperating fully with investigators and emphasized that customer funds remain secure due to the company’s reimbursement commitment. The exchange has not provided a timeline for when normal trading operations will resume.
