Lazarus Group, North Korea’s state-backed hacking unit, is being floated as a strong suspect behind the roughly 45 billion won ($30.7 million) cryptocurrency hacking incident at Upbit, South Korea’s top virtual asset exchange.
Authorities said Friday they are currently conducting an on-site inspection of Upbit, and strongly suspect that Lazarus Group played a part in the heist.
Upbit suffered a massive hacking attack Thursday, resulting in an estimated loss of 44.5 billion won in Solana-based assets.
Regarding the latest breach, Upbit announced it would reimburse the stolen funds in full. The crypto exchange explained that it has shut down all deposit and withdrawal functions for Solana-based assets and transferred the remaining funds from hot wallets to cold storage to prevent further damage.
This is not the first time the North Korean hackers have been linked to an incident involving the exchange. In 2019, the Lazarus Group was suspected of stealing 58 billion won worth of ethereum from Upbit’s custody. A subsequent investigation tentatively concluded that the attack was carried out by North Korean state-backed units, including Lazarus Group.
Notably, the 2019 hack occurred on Nov. 27, the same day as the latest breach. Thursday was also a big day for Dunamu, as it held a joint press conference with portal operator Naver Corp. and its fintech arm Naver Financial Corp., regarding their merger deal.
Like the 2019 theft, cryptocurrencies were taken from Upbit’s "hot wallet." A hot wallet, similar to a bank account, is connected to the internet. It allows for convenient transactions, but it is also more vulnerable to hacking compared to "cold wallets," which are kept offline.
Lazarus Group, controlled by North Korea’s principal intelligence agency Reconnaissance General Bureau, has been accused of multiple high-profile crypto thefts and cyberattacks in an attempt to finance the economically-strained country's military ambitions, including missile programs.
silverstar@heraldcorp.com
