Hackers Steal $28M from Korea’s Wealthy, Police Warn of Rising Global Cyber Threat

Seoul police have brought down a sophisticated hacking network that siphoned millions of dollars from the financial and cryptocurrency accounts of some of South Korea’s wealthiest citizens—including global K-pop star Jungkook of BTS.

The Seoul Metropolitan Police Agency confirmed on Thursday that 16 suspects were arrested, among them two Chinese nationals believed to be the masterminds. The group is accused of operating from bases in China and Thailand between July 2023 and April 2024, stealing ₩39 billion ($28.1 million) through coordinated cyberattacks.

Investigators said the syndicate breached multiple government and financial institution websites to harvest personal information. Using stolen data, they created more than 100 fraudulent mobile accounts, which allowed them to bypass security systems and infiltrate victims’ bank and crypto wallets.

In total, the hackers targeted 258 high-profile individuals, including 28 crypto investors, 75 business leaders, 12 celebrities, and 6 professional athletes. While the organisation profiled hundreds of people, it attempted to rob only 26, whose combined holdings exceeded ₩55 trillion ($39.8 billion).

Funds were successfully drained from 16 victims, with the largest single crypto theft amounting to ₩21.3 billion ($15.4 million). In other cases, swift intervention by financial institutions prevented an additional ₩25 billion ($18 million) in attempted transfers. Authorities also managed to freeze and recover ₩12.8 billion ($9.2 million) for victims.

BTS’s Jungkook narrowly avoided becoming one of the biggest casualties. Hackers reportedly tried to cash out ₩8.4 billion ($6.1 million) in Hybe stock held under his name while he was serving in the military earlier this year. The attempt was flagged as suspicious, and his management intervened before any loss occurred.

Law enforcement emphasised the international dimension of the case. With assistance from Interpol, police arrested the alleged ringleaders in Bangkok. One suspect has already been extradited to Korea to face multiple charges, including network intrusion and economic crimes.

Officials and security experts warn that the case demonstrates a new scale of cybercrime in Korea. “International syndicates are deliberately profiling wealthy Koreans through large-scale breaches of government and telecom systems,” said Rich O., Asia-Pacific regional manager at hardware wallet firm OneKey. He urged stricter telecom identity verification and closer international cooperation to counter increasingly organised attacks.

Oh Gyu-sik, head of Seoul’s 2nd Cyber Investigation Unit, called the incident “unprecedented,” noting that the amounts accessed could have led to “far greater losses” had systems not intervened. He stressed the need for multi-layered defences as Korea remains a prime target for cross-border cybercriminal organisations.