The South Korean police have confirmed that the North Korean hacker groups Lazarus and Andariel were behind the 2019 Upbit theft, stealing 342,000 Ethereum (ETH). The stolen assets were valued at approximately 1.40 trillion Korean Won, of which 57% were exchanged for Bitcoin at a discount and laundered through 51 exchanges. The police successfully recovered 4.8 Bitcoin from a Swiss exchange and returned it to Upbit. This is the first official confirmation of North Korea's involvement in hacking attacks on domestic exchanges. The Lazarus group is known for its sophisticated hacking attacks and has targeted global financial institutions and cryptocurrency exchanges multiple times in recent years.

HIGHLIGHTS South Korean police confirm Lazarus and Andariel groups behind 342,000 ETH theft from Upbit in 2019. 57% of stolen ETH was exchanged for Bitcoin at a discounted rate, laundered via 51 exchanges. Police recover 4.8 BTC from Swiss exchange, returning it to Upbit after four years of investigation. South Korean police confirmed that North Korean hacker Lazarus group and Andariel orchestrated the 2019 theft of 342,000 Ethereum (ETH) from Upbit, South Korea’s largest cryptocurrency exchange. This is the first time authorities have officially acknowledged North Korea's involvement in a domestic exchange hack.

The stolen assets, worth 1.4 trillion won at the current price, flowed through multiple exchanges worldwide. Despite the theft's massive scale, only a small portion was recovered. Specifically, 4.8 Bitcoins were retrieved from a Swiss exchange.
Lazarus and Andariel Steal 342,000 ETH From Upbit
Lazarus and Andariel, North Korea's notorious hacker groups, carried out the 2019 theft of 342,000 ETH from Upbit, South Korean police confirmed. The stolen Ethereum, valued at over 1.4 trillion won (approximately $1 billion), was carefully laundered. According to yna.co report, 57% of the stolen ETH was exchanged for Bitcoin at a 2.5% discount on three exchange sites, likely created by North Korea. Meanwhile, the remaining cryptocurrency flowed through 51 exchanges across 13 countries, including major players in the US and China.

South Korean authorities worked closely with the US FBI and other international agencies to track the stolen assets. Despite many laundered funds being spread across foreign exchanges, the investigation led to a significant recovery. After presenting evidence to Swiss authorities, they successfully recovered 4.8 Bitcoin, worth 600 million won, and returned it to Upbit. This marked a rare instance of recovering stolen funds.

This theft highlights North Korea's increasing reliance on cryptocurrency hacks to fund its activities. The Lazarus Group has led North Korea in carrying out multiple high-profile cyberattacks on top crypto exchanges.

Besides, this report also highlights the growing hacks and scam incidents in the crypto space. For context, the US DOJ has charged five hackers recently for stealing $6.3 million in digital assets.
North Korea's Long History of Crypto Thefts and Global Impact
The Lazarus Group operates as a North Korean state-sponsored cybercrime organization. It carries out sophisticated hacks targeting financial institutions and crypto exchanges globally. The group's operations focus on stealing high-value assets, especially cryptocurrency.

Recently, investigators linked Lazarus to the $238 million Bitcoin theft in August 2023. During this attack, the funds moved across several platforms. Speculation surrounding the group's involvement intensified, as experts analyzed the suspicious transactions.

South Korean police have confirmed that the Lazarus Group is behind the theft of 342,000 ETH from Upbit.