North Korea hackers behind 2019 $42 million Ethereum heist, South Korea police say

South Korean police said on Thursday an investigation confirmed that hackers linked to North Korea's military intelligence agency were responsible for an Ethereum cryptocurrency heist in 2019, worth 58 billion won ($41.5 million) at the time.

More than half of the stolen assets were laundered through three crypto exchanges set up by the hackers themselves at a discount to Bitcoin and the rest were laundered through 51 different exchanges, the National Police Agency said.

The hackers infiltrated a crypto exchange where the Ethereum was being kept and stole 342,000 tokens, now valued at more than 1.4 trillion won ($1 billion), the police said in a statement.

It did not name the exchange but South Korea-based Upbit exchange said at the time it had detected the transfer of 58 billion won of Ethereum to an unidentified wallet.

A National Police Agency official declined to confirm the identity of the hackers, but South Korean media said police had identified them as the Lazarus and Andariel groups linked to the North's Reconnaissance General Bureau affiliated with its military.

The police said its findings were based on an analysis of Internet Protocol addresses used and the subsequent flow of assets. The probe was conducted in cooperation with the U.S. Federal Bureau of Investigation (FBI) and it was the first time North Korea had been identified as the source of a cyberattack on a crypto exchange in South Korea, police said.

In May, a panel of United Nations sanctions monitors said it suspected North Korea mounted 97 cyberattacks on cryptocurrency companies between 2017 and 2024 valued at about $3.6 billion.

Investigators traced 4.8 Bitcoin to a Swiss crypto exchange and recovered them in October and returned them to the Seoul-based exchange, today valued at about 600 million won, police said.

North Korea routinely denies involvement in cyber hacking or crypto heists.