North Korean hacking groups have been tied to most major crypto exchange attacks in South Korea since 2018, while billions of dollars in suspected illicit crypto flows have moved through the country's financial system, according to Crystal Intelligence's 2026 South Korea Country Assessment Report shared with crypto.news.
Lazarus Linked to Six of Nine Major Breaches
The report links North Korea's state-backed Lazarus Group to six of nine major exchange breaches involving South Korean platforms between 2017 and 2025, with confirmed thefts exceeding $120 million. Combined losses across all nine incidents are estimated between $196 million and $225 million. Among the cases is a November 2025 attack on a major domestic exchange that resulted in losses of about $30.4 million; Crystal Intelligence said the incident remains under investigation, though Lazarus is suspected. Earlier breaches include a $49 million Ethereum theft in 2019 and a $100 million cross-chain exploit in 2022 attributed to the group.
Separate findings from Chainalysis, CertiK, and Elliptic already identified North Korea as the dominant source of global crypto theft in 2025, with DPRK-linked hackers stealing about $2.02 billion last year—nearly 60% of the roughly $3.4 billion taken globally. Chainalysis researchers said North Korean operators have increasingly relied on insider infiltration, placing IT workers inside exchanges and crypto firms to gain privileged access. Elliptic and Chainalysis also linked the record-breaking Bybit exploit (estimated at $1.46 billion to $1.5 billion) to DPRK actors.
$6.4 Billion Hwanchigi Laundering Route
The report identified $7.1 billion in illegal crypto transactions in South Korea between 2021 and August 2025, with $6.4 billion attributed to Hwanchigi—a cross-border laundering structure that converts money into crypto offshore before routing it through South Korean exchanges and cashing out in won. Crystal Intelligence described the method as difficult to track without advanced blockchain tracing tools because transactions move through multiple jurisdictions and licensed domestic exchanges using nominee-controlled accounts. In one cited case, South Korean customs authorities dismantled a $113 million Hwanchigi network in January 2026 after a four-year investigation. Another case involved two Russian nationals who allegedly processed more than 6,000 transactions through a Russia-Korea laundering corridor valued at $42 million.
Peer-to-peer markets also remained active outside regulated structures. A March 2026 review of 247 P2P ads across four platforms found settlement methods tied to Chinese payment systems (e.g., Alipay) alongside remittance services including Wise, Western Union, and M-Pesa. These channels complicate traceability as they bypass South Korea's real-name verification rules. Privacy coin Monero appeared in several listings, flagged as carrying elevated money laundering risk. Researchers also identified Telegram and Instagram channels facilitating large in-person crypto cash trades in Seoul's Gangnam, Yeoksam, and Seocho districts, with some transactions reportedly reaching several billion won.
Pig-Butchering Scams and Regulatory Crackdown
Fraud targeting South Korean crypto users accelerated. Pig-butchering scams caused $70.6 million in losses in 2025 across 1,565 incidents, up 48% year-over-year. Approximately 1,000 South Koreans were linked to scam compounds in Cambodia, Myanmar, and Laos. In January 2026 alone, 73 South Korean nationals were repatriated from a deepfake-driven fraud operation that allegedly stole about $33 million from more than 860 victims. Another 64 nationals were brought back from Cambodia in October 2025.
Regulators have tightened oversight. All virtual asset service providers must register with the Korea Financial Intelligence Unit and maintain real-name verified accounts connected to domestic banks. In March 2026, the KoFIU issued its largest enforcement action against a domestic exchange, imposing a $24.6 million fine and a six-month partial suspension over 6.65 million alleged AML violations. The Seoul Administrative Court later overturned the suspension in May 2026.