Crypto Exchange Upbit's 342,000 ETH Stolen in 2019 Traced Back to North Korea by South Korean Police

North Korea Identified in 2019 Upbit Exchange Hack

South Korea’s national police agency revealed on 21 November 2024 that they have traced the 2019 hack of Upbit exchange to North Korea, marking the first time the country has officially named the rogue state behind a cryptocurrency heist.

The attack, which took place in November 2019, saw a staggering 342,000 ETH stolen, a sum worth approximately $41.5 million at the time.

With ether’s price soaring since then, the stolen assets are now valued at over $1 billion.

This revelation sheds light on North Korea’s ongoing involvement in cybercrime targeting the crypto industry.

How the Investigation Unfolded

The South Korean authorities based their findings on a thorough investigation, which included the analysis of multiple pieces of evidence.

These included identifying North Korean IP addresses and tracking the movement of the stolen virtual assets.

Additionally, the use of specific North Korean terminology provided a crucial lead.

South Korea’s police also leveraged their long-standing collaboration with the FBI to connect the dots.

According to a police statement, confirming the country’s suspicion:

“We reached this conclusion based on a comprehensive analysis of evidence obtained through investigation.”

Though the South Korean authorities only referred to the exchange involved as ‘A’, sources have revealed that it was Upbit.

Following the hack, 57% of the stolen ether was converted into Bitcoin at a 2.5% discount via three online exchanges seemingly set up by the attackers.

The rest of the assets were moved across 51 international exchanges before being laundered.

The Role of the FBI and Swiss Authorities

The FBI has long been aware of North Korea’s increasing involvement in crypto-related cybercrime.

It has linked the country to several high-profile hacks, including the $100 million theft from Harmony's Horizon bridge and the $600 million hack of Sky Mavis' Ronin Bridge.

Earlier this year, the agency warned that North Korean hackers were specifically targeting employees in the Web3 sector.

Their persistent efforts to steal cryptocurrencies have raised alarms globally, with many fearing an escalation in such attacks.

In this case, South Korean authorities, in collaboration with Swiss law enforcement, were able to trace part of the stolen funds to a Swiss crypto exchange.

As a result, 4.8 BTC was successfully recovered and returned to Upbit, showing the international effort to combat such cybercrime.