North Korean hacking groups have been linked to several major crypto exchange attacks in South Korea since 2018. A new report from Crystal Intelligence claims that the Lazarus Group, a state-backed hacking group connected to North Korea, was involved in most of the biggest breaches targeting South Korean platforms.<\/p>\n\n\n\n
According to the report, Lazarus has been linked to six out of nine major exchange attacks involving South Korean crypto platforms between 2017 and 2025. Confirmed losses from those attacks exceeded $120 million, while total losses across all nine incidents were estimated between $196 million and $225 million.<\/p>\n\n\n\n
The findings highlight how South Korea remains a major target for cybercriminal groups, especially those seeking crypto assets that can be moved across borders quickly.<\/p>\n\n\n\n
One of the cases mentioned in the report involved a November 2025 attack on a major South Korean exchange. That breach caused losses of around $30.4 million. Crystal Intelligence said the case is still under investigation, but Lazarus is suspected of involvement.<\/p>\n\n\n\n
The report also pointed to earlier attacks, including a $49 million Ethereum theft in 2019 and a $100 million cross-chain exploit in 2022. Researchers have also connected North Korean actors to other large global crypto thefts.<\/p>\n\n\n\n
Separate findings from Chainalysis, CertiK, and Elliptic have also described North Korea as one of the biggest sources of crypto theft worldwide. These firms estimated that DPRK-linked hackers stole about $2.02 billion in 2025, making up nearly 60% of the roughly $3.4 billion stolen across the crypto sector that year.<\/p>\n\n\n\n
Researchers said North Korean hackers are no longer relying only on outside attacks. They are also using insider infiltration tactics.<\/p>\n\n\n\n
According to Chainalysis, North Korean operators have placed IT workers inside exchanges and crypto companies to gain trusted access. This makes attacks harder to detect because the threat may come from someone who appears to be part of the company\u2019s normal workforce.<\/p>\n\n\n\n
Elliptic and Chainalysis also linked the massive Bybit exploit, estimated at around $1.46 billion to $1.5 billion, to DPRK-linked actors.<\/p>\n\n\n\n
Crystal Intelligence also identified $7.1 billion in illegal crypto transactions connected to South Korea between 2021 and August 2025.<\/p>\n\n\n\n
Most of that amount, around $6.4 billion, was tied to Hwanchigi. This is a cross-border laundering method where money is converted into crypto offshore, sent through South Korean exchanges, and then cashed out in won.<\/p>\n\n\n\n
The report said this method is difficult to trace because funds move across several jurisdictions and often pass through licensed exchanges using nominee-controlled accounts.<\/p>\n\n\n\n
In January 2026, South Korean customs authorities broke up a $113 million Hwanchigi network after a four-year investigation. Another case involved two Russian nationals who allegedly processed more than 6,000 transactions through a Russia-Korea laundering route worth $42 million.<\/p>\n\n\n\n
The report also found that peer-to-peer crypto markets remain active outside South Korea\u2019s regulated banking system.<\/p>\n\n\n\n
In March 2026, Crystal Intelligence reviewed 247 P2P advertisements across four platforms. Some of the listings used payment methods connected to Alipay, Wise, Western Union, and M-Pesa.<\/p>\n\n\n\n
These payment channels create extra challenges for investigators because they operate outside South Korea\u2019s real-name verification rules. The report also flagged Monero listings as higher-risk because privacy coins can make transaction tracing more difficult.<\/p>\n\n\n\n
Crystal Intelligence also found Telegram and Instagram channels supporting large in-person crypto cash trades in Seoul, including areas such as Gangnam, Yeoksam, and Seocho.<\/p>\n\n\n\n
Fraud against South Korean crypto users has also increased. Pig-butchering scams caused around $70.6 million in losses across 1,565 incidents in 2025, up 48% from the previous year.<\/p>\n\n\n\n
The report also linked about 1,000 South Koreans to scam compounds operating in Cambodia, Myanmar, and Laos.<\/p>\n\n\n\n
In January 2026, 73 South Korean nationals were repatriated from a deepfake-driven fraud operation that allegedly targeted more than 860 victims and stole around $33 million. Another 64 nationals were brought back from Cambodia in October 2025.<\/p>\n\n\n\n
South Korean regulators have continued increasing pressure on the crypto sector. Under current rules, virtual asset service providers must register with the Korea Financial Intelligence Unit and maintain real-name verified bank accounts.<\/p>\n\n\n\n
In March 2026, the Korea Financial Intelligence Unit issued a major enforcement action against a domestic exchange. The exchange received a $24.6 million fine and a six-month partial suspension over 6.65 million alleged anti-money laundering violations.<\/p>\n\n\n\n
However, the Seoul Administrative Court later overturned the suspension order in May 2026.<\/p>\n\n\n\n
The report shows that South Korea is dealing with several overlapping crypto risks at once. These include North Korean exchange hacks, insider infiltration, cross-border laundering, P2P payment channels, privacy coin risks, and large-scale online fraud.<\/p>\n\n\n\n
For exchanges and regulators, the challenge is no longer limited to stopping one type of attack. They must now deal with organized hacking groups, hidden laundering networks, and scam operations that move across borders.<\/p>\n\n\n\n
The findings also underline why stronger exchange security, real-time blockchain tracing, and stricter anti-money laundering controls remain important for South Korea\u2019s crypto market.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
North Korean hacking groups have been linked to several major crypto exchange attacks in South Korea since 2018. A new report from Crystal Intelligence claims that the Lazarus Group, a state-backed hacking group connected to North Korea, was involved in most of the biggest breaches targeting South Korean platforms. According to the report, Lazarus has…<\/p>\n","protected":false},"author":3,"featured_media":14591,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,70],"tags":[65,625,416],"class_list":["post-14566","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-crypto-news","category-finance","tag-crypto","tag-hackers","tag-north-korean"],"yoast_head":"\n