North Korean State Actors Linked to Major Crypto Exchange Attacks: Crystal Intelligence Report Reveals $120 Million Theft and Laundering Methods

North Korean Hackers Linked to Major Crypto Exchange Attacks, Report Reveals

Amsterdam, Netherlands – May 18, 2026 – A startling new report from Crystal Intelligence has attributed six out of nine significant cyberattacks on South Korean cryptocurrency exchanges since 2018 to state-sponsored hackers from North Korea. The confirmed theft from these attacks has surpassed a staggering $120 million, raising alarms about the growing threat to the crypto landscape in the region.

The 2026 South Korea Country Assessment Report highlights a troubling trend, revealing that between 2021 and August 2025, illegal cryptocurrency transactions in South Korea reached an eye-watering $7.1 billion. Of this, a remarkable $6.4 billion is linked to a sophisticated cross-border laundering method known as Hwanchigi. This technique involves converting funds into cryptocurrency offshore, routing them through domestic exchanges, and ultimately cashing out in South Korean won—a process that poses significant challenges for detection without advanced cross-chain tracing capabilities.

The report estimates that the total losses from all nine exchange incidents between 2017 and 2025 range from $196 million to $225 million. The most recent attack, which occurred in November 2025, targeted a major domestic exchange and resulted in a loss of $30.4 million. Investigations into this incident are still ongoing.

In addition to these cyberattacks, the report documents a sharp increase in crypto-enabled fraud targeting South Korean citizens. In 2025 alone, victims of pig-butchering investment scams lost a staggering $70.6 million, marking a 48% year-on-year increase across 1,565 reported incidents. Alarmingly, around 1,000 South Koreans are currently detained in scam compounds across Cambodia, Myanmar, and Laos, with 73 nationals repatriated from a deepfake-driven fraud network in January 2026.

In response to these threats, South Korea has implemented stringent regulatory measures. All virtual asset service providers (VASPs) are now required to register with the Korea Financial Intelligence Unit (KoFIU) and maintain real-name verified accounts linked to domestic banks—one of the strictest regulatory frameworks in Asia. In March 2026, KoFIU imposed its largest enforcement action to date on a domestic exchange, issuing a $24.6 million fine and a six-month partial suspension for 6.65 million anti-money laundering violations. However, this suspension was later overturned by the Seoul Administrative Court in May 2026.

Despite these efforts, the report indicates that unregulated activity persists. A scan of 247 peer-to-peer advertisements across four platforms in March 2026 revealed the use of foreign domestic payment systems as settlement methods, complicating transaction traceability for compliance teams. Additionally, the presence of a privacy-focused cryptocurrency flagged as carrying elevated money laundering risk raises further concerns.

“South Korea is one of the most important crypto markets in Asia and one of the most complex to navigate,” said Navin Gupta, CEO of Crystal Intelligence. “This report provides compliance teams, law enforcement, and VASPs with the verified intelligence they need to operate with confidence.”

As the landscape of cryptocurrency continues to evolve, the findings of this report underscore the urgent need for enhanced security measures and regulatory oversight to protect against the growing threat of cybercrime.

For more details, read the full report from Crystal Intelligence.

About Crystal Intelligence: Crystal Intelligence offers blockchain intelligence solutions for financial institutions, law enforcement agencies, virtual asset service providers, and regulators. Their platform enables organizations to detect crypto fraud, trace digital funds across over 330 blockchains, and maintain regulatory compliance, all while adhering to ISO 27001 and GDPR standards.