Suspected 2nd leader of hacking ring that stole $25M from celebrities, moguls extradited to Korea

The suspected remaining ringleader behind an international hacking ring believed to have stolen the personal data of wealthy Koreans, including BTS member Jungkook and the chairs of major Korean conglomerates, has been extradited to Korea from Thailand, the Ministry of Justice said Wednesday.

The ring allegedly siphoned 38 billion won ($25.5 million) from victims' stock and cryptocurrency accounts and tried to steal billions more from July 2023 to April last year before financial institutions blocked the transactions.

The suspect was flown into Incheon International Airport from Bangkok on Wednesday morning and is being held in police custody, the ministry said. Police plan to question him as a suspect.

The hacking ring had two ringleaders. The first, identified only by his surname Jeon, was extradited in August last year and is currently on trial. The two men, who attended the same university, organized the hacking operation while traveling between China and Thailand, and conducted attacks on Korean websites.

The ring hacked six Korean government and public agency websites to obtain personal data on 258 people, including resident registration numbers and financial and authentication credentials. Victims included business executives, lawyers, celebrities and athletes. The hackers first filtered the list for the wealthiest targets, then narrowed it further by selecting victims who would have difficulty responding to fraud quickly, including people who were incarcerated or serving in the military.

To monetize the stolen information, the group exploited a loophole in Korea's budget mobile carrier system, which allows remote SIM card activation without in-person verification. The hackers registered SIM cards in the names of 89 victims, then used those phones to pass identity verification checks and drain stocks and cryptocurrency from 16 victims' accounts.

The group also attempted to steal another 25 billion won from 10 additional victims, but financial institutions detected and blocked the transactions. Jungkook's personal information was among the leaked data, and the group nearly made off with 8.4 billion won worth of HYBE shares from his account before a financial institution flagged the unusual activity and his agency suspended the transaction.

Police took victim complaints and worked with Interpol to arrest 16 members of the ring. The two ringleaders were apprehended in Thailand in May of last year. Jeon, who was caught in the act, was sent to Korea in August of last year and is now on trial on 11 charges, including violations of the Information and Communications Network Act and the Act on the Aggravated Punishment of Specific Economic Crimes for fraud.

The second suspect was not caught in the act and could not be arrested under standard judicial procedures, so the Justice Ministry filed a request for emergency provisional detention pending extradition, which Thailand approved.

The mechanism is used to secure custody of a suspect who has fled abroad while extradition proceedings are underway, to prevent further flight. After going through Thailand's extradition process and receiving final approval from local authorities, he was sent to Korea on Wednesday.

"There are no further accomplices requiring extradition," a Justice Ministry official said. "We will continue to respond firmly to transnational crimes such as hacking and online fraud."

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.

BY KIM SEONG-JIN, SUK GYEONG-MIN [[email protected]]