South Korean investigators have confirmed that the 2019 Upbit cryptocurrency heist, which saw $50 million worth of ETH stolen, was carried out by North Korean hacking groups Lazarus and Andariel, which are linked to the Reconnaissance General Bureau, North Korea’s premier intelligence organization.
Upbit, one of South Korea’s leading crypto exchanges, first reported the attack in November 2019, during which 342,000 ETH were stolen from the exchange’s hot wallet. The stolen tokens would be worth over $1.04 billion today. The investigation involved collaboration with the FBI, which identified North Korean IP addresses, virtual asset flow patterns, and vocabulary traces as key evidence.
The authorities have also noted that this is the first time a domestic investigative agency has officially confirmed North Korea’s involvement in virtual asset hacking.
