South Korea blames North Korea for 2019 Ethereum crypto heist worth $41.5 million

South Korean police have confirmed that hackers linked to North Korea’s military intelligence agency orchestrated a massive Ethereum cryptocurrency heist in 2019, stealing 3,42,000 tokens valued at 58 billion won ($41.5 million) at the time.

As per the news agency Reuters, the stolen tokens are now worth over 1.4 trillion won ($1 billion), according to the National Police Agency, which announced the findings on Thursday.

The investigation, conducted with assistance from the US Federal Bureau of Investigation (FBI), marks the first official identification of North Korea as the source of a cyberattack on a South Korean cryptocurrency exchange.

Police attributed the attack to the Lazarus and Andariel groups, both linked to the North’s Reconnaissance General Bureau, which operates under its military intelligence.

How the heist unfoldedHackers infiltrated a South Korea-based cryptocurrency exchange and transferred the stolen Ethereum to unidentified wallets. Although authorities did not name the targeted platform, Upbit, a major South Korean exchange, reported a loss of Ethereum worth 58 billion won in 2019.

More than half of the stolen assets were laundered through three crypto exchanges allegedly created by the hackers. The remaining funds were funnelled through 51 other exchanges, often traded at a discount for Bitcoin to obfuscate the origins of the funds.
The police investigation relied on analysing Internet Protocol (IP) addresses and tracing the flow of stolen assets. A breakthrough came in October when investigators recovered 4.8 Bitcoin, now valued at 600 million won, from a Swiss cryptocurrency exchange and returned them to the Seoul-based exchange.
In May, a United Nations panel of sanctions monitors disclosed that North Korea had conducted 97 cyberattacks on cryptocurrency platforms between 2017 and 2024, amassing approximately $3.6 billion. Despite repeated accusations, Pyongyang has consistently denied involvement in cyber hacking or cryptocurrency theft.