North Korea to blame for 342,000 ETH Upbit hack in 2019, South Korean police say

South Korea has identified North Korea as the perpetrator behind the 342,000 ETH hack from Upbit exchange in November 2019, the country’s national police agency announced Thursday. 

According to the South Korean police, this is the first instance where the country has identified North Korea as the illicit actor behind a cryptocurrency heist.

“[We] reached this conclusion based on a comprehensive analysis of evidence obtained through investigation, including North Korean IP addresses, flow of virtual assets, and the use of North Korean terminology, and data from our long-term collaborative effort with the Federal Bureau of Investigation (FBI)," the statement said.

While the statement only referred to the exchange as 'A,' South Korean police confirmed to The Block that the victim was Upbit. The 342,000 ETH stolen in 2019 was worth approximately $41.5 million at the time. Due to the significant increase in ether’s price, the stolen tokens are now worth over $1 billion.

Around 57% of the stolen ether was converted into bitcoin at a 2.5% discount via three online exchanges that appear to be established by the attacker, according to the statement. The remainder were sent across 51 overseas exchanges and then laundered.

South Korean police, in collaboration with Swiss authorities, returned 4.8 BTC of the stolen funds to Upbit after it traced the cryptocurrency to a Swiss crypto exchange.

FBI has previously identified North Korea-backed hackers as the attackers behind several major crypto hacks, including the $100 million hack of Harmony's Horizon bridge and the $600 million hack of Sky Mavis' Ronin Bridge. The agency warned earlier this year that North Korean cybercriminals are "aggressively targeting" employees in the Web3 industry in a persistent effort to steal cryptocurrencies.