Accusation of $50M Upbit Hack Leveled Against North Korea

YEREVAN (CoinChapter.com)—South Korea has officially linked North Korean hacking groups Lazarus and Andariel to the 2019 Upbit hack, which resulted in the theft of $50 million in cryptocurrency. The announcement came on Nov. 21 from the country’s National Office of Investigation, confirming details of the cyberattack after nearly five years.
The hackers reportedly targeted the hot wallet of Upbit, a South Korean cryptocurrency exchange. The attack compromised 342,000 Ether (ETH), valued at $147 per coin. This amounted to a total loss of $50 million. Today, the value of the stolen Ether exceeds $1 billion, reflecting the increase in crypto prices.
How Investigators Confirmed North Korean Involvement
Authorities traced the stolen cryptocurrency’s movements through crypto flow tracking and examined IP addresses used during the hack. They also analyzed the hacking operations’ linguistic style, identifying it as consistent with North Korean communication methods.
South Korean investigators collaborated with the United States Federal Bureau of Investigation (FBI) to strengthen their findings. Despite confirming North Korea’s involvement, they did not disclose specific hacking techniques to prevent copycat crimes.
Further analysis revealed that 57% of the stolen Ether had been sold through exchanges reportedly controlled by North Korean operatives. The remaining funds were distributed across 51 overseas exchanges to obscure their origin, complicating recovery efforts.
Upbit Faces KYC Violation Allegations
In addition to the investigation into the Upbit hack, the exchange faces allegations of Know Your Customer (KYC) compliance violations.
On Nov. 14, the Financial Intelligence Unit (FIU) under South Korea’s Financial Services Commission uncovered 600,000 potential violations involving blurred user identification documents.
The FIU found that Upbit accepted these documents, making it difficult for authorities to verify customer identities. The violations could lead to fines of up to $71,500 per case, potentially creating additional challenges for the exchange.