Korean Authorities Point to Lazarus Group in Upbit’s ₩44.5B Hack
The post Korean Authorities Point to Lazarus Group in Upbit’s ₩44.5B Hack appeared on BitcoinEthereumNews.com.
South Korea’s regulators say North Korea’s Lazarus Group is now the prime suspect behind the ₩44.5 billion (~$32–36 million) hack on Upbit, the country’s largest crypto exchange. Investigators say the on-chain trail looks almost identical to the group’s previous operations, including Upbit’s infamous 2019 breach. The attack hit on November 27, triggering an immediate freeze on withdrawals and transfers. Upbit confirmed that funds vanished from one of its hot wallets, affecting several assets, SOL, USDC, BONK, JUP, and others. While the exchange says users will be fully compensated from its reserves, the incident marks another damaging blow to trust in local crypto infrastructure. And the fingerprints are familiar. A Pattern Authorities Know Too Well Investigators began tracing the exploited wallet minutes after the hack. What they found matched a blueprint they’ve seen repeatedly over the past five years. The stolen assets were: Swapped instantly on Jupiter and Raydium Split across more than 200 wallets Bridged through Wormhole Pushed into a laundering cycle resembling mixer-style dispersion The flow mirrors the techniques Lazarus has used in hacks across the world. Korea’s cybercrime teams pointed to “wallet-hopping patterns and mixing behavior identical to Lazarus operations,” according to local media briefings and early reporting from Crypto Times. 🚨UPDATE: Korean authorities say North Korea’s Lazarus Group is the key suspect in Upbit’s ₩44.5B (~$32M) hack. Investigators traced wallet-hops and mixing patterns identical to previous Lazarus ops, including Upbit’s 2019 breach. FSS and KISA have launched an on-site… pic.twitter.com/NhJwskSv1S — The Crypto Times (@CryptoTimes_io) November 28, 2025 Authorities say this includes the same tactics seen in the 2019 Upbit breach, at that time, $50 million in ETH disappeared using a near-identical playbook. The new attack’s precision, timing, and laundering methods only strengthened the suspicion. The $36M Breach: What Happened Upbit classified the event as an external…
