South Korea extradites mastermind of $1.18M crypto heist from Lithuania

South Korea has announced that it has extradited a hacker who stole more than 1.7 billion (approximately $1.8 million) worth of digital assets. According to reports, the 29-year-old Lithuanian national stands accused of using malware to secretly alter the wallet addresses where digital assets were meant to be sent.

The development was announced by the National Office of Investigation (NOI), a division under the Korean National Police Agency, on Sunday, highlighting that the Lithuanian national had been extradited from Georgia.

The NOI claims that the suspect has been fingered in a campaign that stole digital assets from victims in Korea and other countries.

South Korea extradites hacker to face the law

According to reports, the suspect carried out his operation from April 2020 to January 2023, targeting unsuspecting victims by distributing malicious software called KMSAuto disguised as a Microsoft Windows activation tool.

Investigators claimed that malware, which was shared more than 2 million times worldwide, employed a memory hacking technique that automatically replaces cryptocurrency wallet addresses with the hacker’s during transactions.

The scheme targeted only users who did not use licensed activation software. Reports claimed that more than 3,100 wallets were infected worldwide, and the criminal was able to intercept digital asset transactions 840 times, with the total of those transactions coming to 1.7 billion won. Among his victims were eight Korean nationals, who authorities claimed lost a combined 16 million won.

Police mentioned that the hacker first appeared on their radar in August 2020 after receiving a report from a user who claimed to have lost one Bitcoin. The digital asset was worth 12 million won at the time, with the user claiming that they sent the asset to a known wallet, but the transaction was redirected to the wrong wallet address.

Investigations traced the stolen digital assets to six countries, including domestic exchanges, and identified seven more Korean victims.

After several investigations, the Koreans claimed that they were able to identify the suspect. The police said it carried out a coordinated operation with Lithuania’s Ministry of Justice, prosecutors, and police in December last year.

During the joint operations, local authorities in Lithuania raided the suspect’s residence and seized 22 items, including several mobile phones, laptops, and other items. To pursue prosecution in Korea, the police also requested a red notice from Interpol.

Police promise to respond strongly to cybercriminals

The suspect was eventually apprehended by Georgian authorities after he entered the country in April. Korean authorities requested an extradition from Georgia, and after a five-year and four-month investigation, the police were able to bring the suspect to Korea, where he was arrested pursuant to a court-ordered warrant.

In its statement, the Korean police urged residents to be at peace, assuring them that they will apprehend criminal elements targeting them.

In addition, Park Woo-hyun, head of cyber investigations at the National Police Agency, thanked the countries involved for their cooperation on the issue. He also mentioned that Korea will continue to respond strongly and firmly to borderless cybercrime through global law enforcement collaboration and extradition.

Meanwhile, residents have been warned to be watchful when using digital assets and report to the police once they discover that they have become a victim of theft.

The Korean police have also warned residents to desist from illegal activities and affiliations with questionable characters.

The statement was made in response to a conviction of a South Korean native who lost an appeal over his collaboration with a North Korean hacker to keep an illegal online game server running. Authorities claimed that the defendant and the hacker exchanged multiple messages and received security-disabling software for which he paid a total of $16,300.

Get seen where it counts. Advertise in Cryptopolitan Research and reach crypto’s sharpest investors and builders.