On Sept. 29, a South Korean human rights group said a North Korean hacker working in China to steal cryptocurrency failed in a bid to defect to South Korea, was later detained by North Korean authorities, and was sent back to Pyongyang in August 2023 with his body locked in plaster casts and seated in a wheelchair. Transitional Justice Working Group, or TJWG, said it decided to reveal his identity only after confirming that he had died in North Korea.
TJWG report names the hacker
The report is called North Korea’s Transnational Repression: China. It names the hacker as 배용주, a Korean name rendered by media outlets including The Korea Herald as Pae Yong-ju. Citing passport information, those reports said he was born in Pyongyang in November 1988.
According to the English edition of Korea JoongAng Daily and other South Korean media reports, Pae graduated from Madonghui Military University, described as a school that trains personnel for intelligence work aimed at South Korea. He was later sent to China. His tasks, the reports said, included stealing cryptocurrency, hacking South Korean government institutions, and collecting information on Chinese military organizations. But none of the cited reports said how much cryptocurrency he had stolen.
Detained in China, then held through North Korean diplomatic channels
TJWG said Pae tried to get to South Korea through Mongolia but was arrested by Chinese authorities in Inner Mongolia. After roughly six months of questioning by Chinese state security authorities, he was handed over to North Korea through the North Korean consulate general in Shenyang, the report said. Then he was moved to the consular section of North Korea's embassy in Beijing, where he was detained and interrogated for about a year.
In August 2023, flights between Pyongyang and Beijing restarted after a suspension lasting three years and seven months, and Pae was sent back to Pyongyang then. Asia Business Daily, citing a trader involved in business with North Korea, reported that North Korean authorities "tied up his joints and fixed them directly with plaster so he could neither cry out nor move." Then they put him in a wheelchair and took him onto an Air Koryo flight leaving Beijing.
TJWG said the setup appeared meant to make the repatriation look like the transport of a sick passenger, while also stopping resistance or escape. Lee Seungjoo, a TJWG researcher, told SBS the group had not released the case earlier because it could not confirm whether Pae was alive or dead. After confirming his death, it chose to disclose the case. So far, public reports have not said when he died or what caused his death.
Basement of Beijing embassy consular building described as a detention site
TJWG said the report was built on interviews with more than 10 current and former North Korean officials, along with reporting from specialist media focused on North Korea. The group said the basement of the consular building at North Korea's embassy in Beijing's Chaoyang district had been used to hold North Koreans suspected of trying to defect. A former North Korean diplomat told TJWG: "The basement of the consular building is a prison."
The report said North Korea puts special focus on monitoring diplomats, students studying abroad, party cadres, weapons and science specialists, hackers, and overseas laborers, arguing that any leak of the information they hold could damage the North Korean leadership. It also said "security representatives" stationed at diplomatic missions use consular titles and report back to Pyongyang within 12 to 24 hours if someone goes missing.
TJWG divides such operations into three types
TJWG said North Korea's operations of this kind in China fall into three groups:
- operations carried out directly by North Korean intelligence personnel;
- cases in which Chinese authorities know but quietly allow them;
- cases in which China actively helps track down and transfer the target.
In this case, the report says Pae Yong-ju had been stealing cryptocurrency for North Korea while in China, was caught after trying to defect to South Korea, and was later transferred through Chinese and North Korean diplomatic channels before being returned to Pyongyang. And the public record says only that he later died in North Korea. No public report cited here gave a time or cause of death.