The Perennial Threat: How North Korean Hackers Exploit South Korean Crypto Exchanges

By: crypto insight|2025/11/27 08:30:05

Key Takeaways

Repeated Breaches: South Korean crypto exchanges, including Upbit and Bithumb, have suffered significant breaches over the past eight years, largely attributed to North Korean hacking groups.
Lazarus Group’s Role: The North Korean Lazarus Group leads these cyberattacks, funneling stolen cryptocurrencies into North Korea’s nuclear and missile programs.
Market Dynamics: South Korea’s unique market conditions, such as the “Kimchi Premium,” make it a prime target for hackers.
Persistent Vulnerabilities: Despite regulatory advancements, exchanges remain vulnerable due to structural and geopolitical challenges.

WEEX Crypto News, 2025-11-27 08:03:15

In the predawn darkness of November 27, 2025, a chilling replay of past cyber heists unfolded as South Korea’s largest cryptocurrency exchange, Upbit, found itself under siege once more. At the stroke of 4:42 AM Korean Standard Time, a massive and unauthorized outflow rocked its Solana hot wallet, resulting in the loss of approximately 54 billion won (around 36.8 million USD). This breach added yet another chapter to the storied and tumultuous history between South Korean exchanges and North Korean hackers, epitomized by the notorious Lazarus Group.

History Repeating: Upbit and Its Folly

This latest breach echoes the notorious 2019 Upbit hack when the exchange lost a staggering 342,000 ETH, which was valued at an equivalent amount during its time. Lazarus Group is believed to be behind both attacks, employing sophisticated methods such as the Peel Chain technique to obfuscate and redistribute the assets across unregulated exchanges. Despite attempts at regulatory compliance following the 2019 breach, such as adhering to South Korea’s Specified Financial Information Act, Upbit, alongside other exchanges, remains in the crosshairs of state-sponsored hackers.

The reoccurrence of such incidents highlights a systemic vulnerability in the crypto sector, especially in regions heavily targeted for geopolitical leverage. While Upbit promises users full compensation using private reserves, the incident underscores the persistent threat and challenge in securing digital assets.

An Eight-Year Struggle: South Korea’s Crypto Woes

To fully appreciate the gravity of the situation, one must trace back to 2017, a significant milestone that ignited Korea’s crypto boom and, concurrently, its cybersecurity nightmare. That year, Bithumb, another major exchange, suffered a catastrophic data breach. Hackers infiltrated an employee’s computer, leveraging unsecured customer data to execute targeted phishing scams that siphoned off roughly $32 million.

Bithumb’s plight was but a precursor to the fall of Youbit, a mid-sized exchange that capitulated under the weight of successive cyberattacks within the same year. Acknowledging the threat, the Korea Internet & Security Agency (KISA) openly attributed these breaches to North Korean operatives, signaling the arrival of a new breed of cyber adversaries.

In 2018, the trend continued with brazen, high-profile heists. Coinrail was hit, costing them over $40 million, while Bithumb experienced its third hack, losing approximately $31 million in various digital currencies. The compromised assets primarily included in-demand ICO tokens, reflecting the evolving tactics of the cybercriminals who tracked market trends to maximize profits and disruption.

Lazarus Group: The Specialist in Cyber Warfare

Lazarus Group, a cyberwarfare entity under North Korea’s Reconnaissance General Bureau, has cemented itself as a formidable opponent in the cyber realm. Initially capturing global attention with audacious operations against Sony Pictures in 2014 and the Bangladesh Bank in 2016, Lazarus has fine-tuned its expertise to exploit the burgeoning crypto domain.

The motivations driving Lazarus are multifaceted. Beyond financial gain, these operations are a geopolitical tool designed to destabilize adversary nations while circumventing international sanctions. Notably, stolen funds have been tracked flowing directly into North Korea’s nuclear and missile projects, as substantiated by various United Nations reports. Anne Neuberger, the Deputy National Security Advisor of the United States, confirmed in 2023 that 50% of North Korea’s missile projects are financed through such cyberattacks.

South Korea: A Lucrative, Yet Perilous Target

South Korea’s particular vulnerability stems from several factors. The “Kimchi Premium,” a condition where cryptocurrency prices are inflated relative to global rates, makes the market especially attractive. The cause of this premium lies in the high demand from fervent local traders who drive prices above international averages. This premium, in essence, heralds larger sums being parked in exchanges as traders move capital in pursuit of arbitrage opportunities.

Furthermore, the close cultural and linguistic ties between North and South Korea afford hackers an edge in executing social engineering attacks. North Korean operatives readily imitate familiar communication styles, manipulate consumer trust, and extract sensitive information through phishing tactics that would be more noticeable in other regions.

Beyond Borders: The Global Implications

While South Korea serves as a poignant case study, the issue transcends national borders. According to multiple investigations, Russian threat actors are interlinked with numerous significant DeFi attacks globally, and Iranian hackers have initiated similar assaults on Israeli crypto platforms. Moreover, North Korean efforts now extend to targets beyond Korean Peninsula conflicts, as seen with grandiose heists like the 2022 Ronin bridge hack.

These incidents unveil a structural challenge within the cryptocurrency industry: the dependence on centralized points of transaction. Despite the inherent security of blockchain technology, user assets remain exposed while navigating through exchanges and wallet intermediaries that might lack robust security measures.

Exchanges, by nature, are custodians of vast digital wealth, often surpassing their defensive capabilities. The asymmetric warfare observed between profit-motivated private entities and state-backed attack groups exasperates this predicament, where mistakes on the exchange’s part can result in severe ramifications.

Securing the Future: An Ongoing Endeavor

In light of these persistent threats, a coordinated endeavor encompassing regulatory oversight, advanced security protocol adoption, and international collaboration remains vital. To protect both financial and national security interests, exchanges must deploy comprehensive defense mechanisms, continuously upgrade infrastructure, and foster a culture of proactive vigilance against potential threats.

The role of international coalitions cannot be overstated. Countries must cooperate to curtail the efficacy of illicit fund flows, coordinating sanctions and facilitating asset recovery. Strengthening cross-border alliances will be instrumental in addressing the root challenges stemming from countries harboring these cyberwarfare units, especially those like North Korea.

In conclusion, as the geopolitical chess game continues to unfold with cryptocurrency at its nexus, vigilance remains the key. South Korea’s crypto exchanges, while currently encumbered by these challenges, are part of a larger narrative where ensuring security means recognizing the interconnected vulnerabilities that span across borders. This ongoing cyberwarfare saga reminds us all of the rapid, ever-evolving theater of modern conflict, where the frontline stretches invisibly across countries and cyberspaces.

FAQs

What strategies do North Korean hackers use against South Korean exchanges?

North Korean hackers employ a mix of technical and social engineering tactics, including phishing schemes, direct hacking into systems, and complex methods like the Peel Chain technique to obscure fund traces post-theft.

Why is South Korea a preferred target for crypto hackers?

South Korea is targeted for its lucrative crypto market characterized by the “Kimchi Premium,” extensive trading volumes, and cultural commonalities that make phishing techniques more successful.

How have these attacks impacted South Korean exchanges and their users?

The attacks have led to significant financial losses for exchanges, shaken investor confidence, and prompted regulatory reforms aimed at increasing security measures within the crypto sector.

What role does the Lazarus Group play in these cyberattacks?

The Lazarus Group, a North Korean state-sponsored hacking collective, is central to these attacks. Their operations fund North Korea’s nuclear arsenal by stealing and laundering cryptocurrency from foreign exchanges.

How can exchanges better protect against such cyber threats?

Exchanges can enhance their defenses through improved security protocols, regular audits, advanced threat detection systems, compliance with international security standards, and fostering global cooperation to track and recover stolen assets.

AI trading is already core market infrastructure, but regulators still treat it as a tool — responsibility always stays with the humans and platforms behind it. The biggest risk in 2025 is not rogue algorithms, but mass-adopted AI strategies that move markets in sync and blur the line between tools and unlicensed advice. The next phase of AI trading is defined by accountability and transparency, not performance — compliance is now a survival requirement, not a constraint.

Ether pumps to outsiders, dumps in-house. Can Tom Lee's team still be trusted?

Tom Lee publicly bullish, while Fundstrat internally bearish, this public narrative versus internal strategy contradiction also puts Tom Lee himself and his associated organization in the spotlight.

Coinbase Joins Prediction Market, AAVE Governance Dispute - What's the Overseas Crypto Community Talking About Today?

Publication Date: December 23, 2025Author: BlockBeats Editorial Team

Over the past 24 hours, the crypto market has shown strong momentum across multiple dimensions. The mainstream discussion has focused on Coinbase's official entry into the prediction market through the acquisition of The Clearing Company, as well as the intense controversy within the AAVE community regarding token incentives and governance rights.

In terms of ecosystem development, Solana has introduced the innovative Kora fee layer aimed at reducing user transaction costs; meanwhile, the Perp DEX competition has intensified, with the showdown between Hyperliquid and Lighter sparking widespread community discussion on the future of decentralized derivatives.

I. Mainstream Topics

1. Coinbase Acquires The Clearing Company, Officially Entering Prediction Market

This week, Coinbase announced the acquisition of The Clearing Company, marking another significant move to deepen its presence in this field after last week's announcement of launching a prediction market on its platform.

The Clearing Company's founder, Toni Gemayel, and the team will join Coinbase to jointly drive the development of the prediction market business.

Coinbase's Product Lead, Shan Aggarwal, stated that the growth of the prediction market is still in its early stages and predicts that 2026 will be the breakout year for this field.

The community has reacted positively to this, generally believing that Coinbase's entry will bring significant traffic and compliance advantages to the prediction market. However, this has also sparked discussions about the industry's competitive landscape.

Jai Bhavnani, Founder of Rivalry, commented that for startups, if their product model proves to be successful, industry giants like Coinbase have ample reason to replicate it.

This serves as a reminder to all entrepreneurs in the crypto space that they must build significant moats to withstand competition pressure from these giants.

2. Kalshi Launches Kalshi Research and Integrates BSC Network

Regulated prediction market platform Kalshi launched its research arm, Kalshi Research, this week, aimed at opening its internal data to the academic community and researchers to facilitate exploration of prediction market-related topics.

Its inaugural research report highlights Kalshi's outperformance in predicting inflation compared to Wall Street's traditional models. Kalshi co-founder Luana Lopes Lara commented that the power of prediction markets lies in the valuable data they generate, and it is now time to better utilize this data.

Meanwhile, Kalshi announced its support for the BNB Chain (BSC), allowing users to deposit and withdraw BNB and USDT via the BSC network.

This move is seen as a significant step for Kalshi to open its platform to a broader crypto user base, aiming to unlock access to the world's largest prediction market. Furthermore, Kalshi also revealed plans to host the first Prediction Market Summit in 2026 to further drive industry engagement and development.

3. AAVE Token Incentive Controversy Persists as Founders and Whales Increase Holdings Against the Market Trend

The AAVE community recently engaged in heated debates around an Aave Improvement Proposal (AIP) titled "AAVE Tokenomics Alignment Phase One - Ownership Governance," aiming to transfer ownership and control of the Aave brand from Aave Labs to Aave DAO.

Aave founder Stani Kulechov publicly stated his intention to vote against the proposal, believing it oversimplifies the complex legal and operational structure, potentially slowing down the development process of core products like Aave V4.

The community's reaction was polarized. Some criticized Stani for adopting a "double standard" in governance and questioned whether his team had siphoned off protocol revenue, while others supported his cautious stance, arguing that significant governance changes require more thorough discussion.

This controversy highlights the tension between the ideal of DAO governance in DeFi projects and the actual power held by core development teams.

Despite governance disputes putting pressure on the AAVE token price, on-chain data shows that Stani Kulechov himself has purchased millions of dollars' worth of AAVE in the past few hours.

Simultaneously, a whale address, 0xDDC4, which had been quiet for 6 months, once again spent 500 ETH (approximately $1.53 million) to purchase 9,629 AAVE tokens. Data indicates that this whale has accumulated nearly 40,000 AAVE over the past year but is currently in an unrealized loss position.

The founder and whale's increased holdings during market volatility were interpreted by some investors as a confidence signal in AAVE's long-term value.

4. Top Articles: DeFi Curators and Ethereum Annual Summary

In this week's top article, Morpho Labs' "Curator Explained" detailed the role of "curators" in DeFi.

The article likened curators to asset managers in traditional finance, who design, deploy, and manage on-chain vaults, providing users with a one-click diversified investment portfolio.

Unlike traditional fund managers, DeFi curators execute strategies automatically through non-custodial smart contracts, allowing users to maintain full control of their assets. The article offered a new perspective on the specialization and risk management in the DeFi space.

Another widely circulated article, "Ethereum 2025: From Experiment to Global Infrastructure," provided a comprehensive summary of Ethereum's development over the past year. The article noted that 2025 is a crucial year for Ethereum's transition from an experimental project to global financial infrastructure. Through the Pectra and Fusaka hard forks, Ethereum achieved significant reductions in account abstraction and transaction costs.

Furthermore, the SEC's clarification of Ethereum's "non-securities" nature and the launch of tokenized funds on the Ethereum mainnet by traditional financial giants like JPMorgan marked Ethereum's gaining recognition from mainstream institutions. The article suggested that whether it is the continued growth of DeFi, the thriving L2 ecosystem, or the integration with the AI field, Ethereum's vision as the "world computer" is gradually becoming a reality.

II. Mainstream Ecosystem Updates

1. Solana: Launches Kora Fee Layer and propAMM Data Research

The Solana Foundation engineering team released a fee layer solution called Kora this week.

Kora is a fee relayer and signatory node designed to provide the Solana ecosystem with a more flexible transaction fee payment method. Through Kora, users will be able to achieve gas-free transactions or choose to pay network fees using any stablecoin or SPL token. This innovation is seen as an important step in lowering the barrier of entry for new users and improving Solana network's availability.

Additionally, a deep research report on propAMM (proactive market maker) sparked community interest. The report's data analysis of propAMMs on Solana like HumidiFi indicated that Solana has achieved, or even surpassed, the level of transaction execution quality in traditional finance (TradFi) markets.

For example, on the SOL-USDC trading pair, HumidiFi is able to provide a highly competitive spread for large trades (0.4-1.6 bps), which is already better than the trading slippage of some mid-cap stocks in traditional markets.

Research suggests that propAMM is making the vision of the "Internet Capital Market" a reality, with Solana emerging as the prime venue for all of this to happen.

2. Perp DEX: Hyperliquid vs. Lighter Competition Intensifies

The competition in the perpetual contract DEX (Perp DEX) space is becoming increasingly heated.

In its latest official article, Hyperliquid has positioned its emerging competitor, Lighter, alongside centralized exchanges like Binance, referring to it as a platform utilizing a centralized sequencer. Hyperliquid emphasizes its transparency advantage of being "fully on-chain, operated by a validator network, and with no hidden state."

The community widely interprets this as Hyperliquid declaring "war" on Lighter. The technical differences between the two platforms have also become a focal point of discussion: Hyperliquid focuses on ultimate on-chain transparency, while Lighter emphasizes achieving "verifiable execution" through zero-knowledge proofs to provide users with a Central Limit Order Book (CLOB)-like trading experience.

This battle over the future direction of decentralized derivatives exchanges is expected to peak in 2026.

Meanwhile, discussions about Lighter's trading fees have surfaced. Some users have pointed out that Lighter charged as much as 81 basis points (0.81%) for a $2 million USD/JPY forex trade, far exceeding the near-zero spreads of traditional forex brokers.

Some argue that Lighter does not follow a B-book model that bets against market makers, instead anchoring its prices to the TradFi market, and the high fees may be related to the current liquidity or market maker balance incentives. Providing a more competitive spread for real-world assets (RWA) in the highly volatile crypto market is a key issue Lighter will need to address in the future.

The Secret Centralization Landscape of Stablecoin Payments: 85% of Transaction Volume Controlled by Top 1000 Wallets

Stablecoin payments have reached nearly half of total transaction volume, but are highly concentrated in a few institutional wallets: the top 1000 addresses contributed to about 85% of the transfer volume. While P2P transactions are numerous, their share of the total amount is significantly low.

Why Did Market Sentiment Completely Collapse in 2025? Decoding Messari's Ten-Thousand-Word Annual Report

If cryptocurrency is ultimately a form of “money,” then who is worthy of being treated as money?

Twitter 上的「虚假流量」是指通过操纵关注者数量、喜欢和转发等指标来人为增加一条推文的影响力和可信度。下面是一些常见的制造虚假流量的方法： 1. 购买关注者： 一些用户会通过购买关注者来迅速增加他们的关注者数量，从而让他们的账号看起来更受欢迎。 2. 使用机器人账号： 制造虚假流量的另一种常见方法是使用机器人账号自动执行喜欢、转发和评论等互动操作，从而提高一条推文的互动量。 3. 推文交换： 一些用户之间会进行推文交换，即互相喜欢、转发对方的推文...

Why Did Musk and His Tweets Have to Do This?