North Korea’s Lazarus Group Tied to $30 Million Hack of South Korean Exchange Upbit

North Korea’s infamous cybercrime group, known as Lazarus Group, is under suspicion for a significant cryptocurrency heist that resulted in the theft of around $30.6 million from Upbit, South Korea's largest cryptocurrency exchange.

Key Takeaways

Lazarus Group, linked to North Korea, is suspected to have stolen about $30.6 million from Upbit.
Upbit’s operator, Dunamu, has pledged to fully reimburse affected users and has paused all transactions.
Authorities report that the stolen funds were quickly laundered through various wallets, consistent with Lazarus's previous tactics.

Authorities are set to perform an on-site investigation at Upbit following indications that the recent cyber attack could be related to previous breaches associated with the Lazarus Group, according to Yonhap News, which cited both government and industry insiders.

This group has a history of orchestrating cryptocurrency thefts aimed at generating funds for North Korea as it grapples with ongoing foreign currency shortages.

$30M Hack at South Korean Exchange Upbit

Dunamu to Reimburse Users After $30 Million Hack Linked to Solana at Upbit

Upbit’s operator, Dunamu, confirmed that assets associated with Solana, valued at 44.5 billion won, were transferred to an unauthorized wallet on Thursday.

The company announced it will cover all user losses using its reserves and took immediate action to suspend all withdrawals and deposits while conducting internal investigations.

Investigators noted that the methods used in this hack closely mirrored a 2019 attack, during which approximately 58 billion won in Ethereum was reportedly stolen from the same exchange.

Officials suspect that this time, the hackers might have gained access to critical infrastructure by impersonating system administrators or compromising internal accounts to authorize the withdrawals.

Security experts indicated that the stolen funds were quickly circulated through wallets linked to different platforms, suggesting an effort to obscure transaction trails through laundering methods previously utilized by Lazarus.

“It’s their typical strategy to spread tokens across multiple networks to evade detection,” one official explained.

Analysts observed that Lazarus has consistently targeted high-profile cryptocurrency platforms to enhance the impact and visibility of their attacks, implying this hack might have been strategically timed to capitalize on increased public awareness.

Earlier this month, South Korea hinted at a potential reassessment of its sanctions policy regarding North Korea, particularly after new US measures revealed links between Pyongyang’s cryptocurrency theft activities and its weapons funding.

Second Vice Foreign Minister Kim Ji-na remarked that Seoul is willing to “review sanctions as necessary,” emphasizing the importance of close cooperation with Washington to combat North Korea's escalating cyber threats.

“In incidents of cryptocurrency theft by North Korea, collaboration between South Korea and the US is crucial, as such funds could finance Pyongyang’s nuclear and missile initiatives and represent a risk to our digital ecosystem,” Kim stated.

Naver Plans to Acquire Dunamu

The hack on Upbit occurred just a day after Naver announced its intention to acquire Dunamu through a share-swap agreement, bringing considerable attention to the exchange.

In parallel, Naver Financial, the financial technology division of South Korean internet giant Naver, is preparing to launch a stablecoin wallet in Busan as part of the city’s initiative to develop a blockchain-based local economy.

Naver has reportedly completed the development of the wallet, which is currently undergoing final checks ahead of its anticipated launch next month.

This project is being executed in collaboration with venture capital firm Hashed and the Busan Digital Asset Exchange (BDAN), which is responsible for the broader digital asset strategy in Busan.