South Korea Blacklists North Korean Crypto Thieves, Flags Wallet Addresses

The government sanctions targeted four individuals and seven institutions – some with alleged ties to the elite North Korean hacking group Lazarus.

AccessTimeIconFeb 10, 2023 at 11:23 a.m. UTC
Updated Feb 10, 2023 at 4:19 p.m. UTC

The South Korean government has blacklisted four North Korean individuals and seven institutions that allegedly financed "nuclear and missile development" with illegal cyber activities, including crypto theft.

"This is the first independent sanctions against North Korea in the cyber sector by the South Korean government," a Ministry of Foreign Affairs notice from Friday said. "It is expected that it will serve as an opportunity to alert the world to the risk of virtual asset trading with North Korea by including the virtual asset wallet address as the identification information of the subject of sanctions."

Crypto theft in North Korea hit a record high in 2022. A pair of North Korean hacker groups also orchestrated the theft of $100 million in crypto from Horizon Bridge, the U.S. Federal Bureau of Investigation said in January. A U.S. blacklisted Ethereum wallet allegedly tied to elite North Korean hacker group Lazarus was also involved in a $600 million hack last March.

The South Korean sanctions targeted individuals with suspected ties to Lazarus. The individuals named include Park Jin-hyeok of the Chosun Expo joint venture company, which is an alleged front for Lazarus.

The seven institutions targeted for sanctions allegedly participated in cyberattacks "such as hacking and theft of virtual assets" or training cyber experts, the notice said.

Under regulations, it's forbidden to trade crypto with a blacklisted entity without prior permission from South Korea's Financial Services Commission, the notice added. Crypto transactions are included in the country's regulations prohibiting the financing of terrorism.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Sandali Handagama

Sandali Handagama is CoinDesk's deputy managing editor for policy and regulations, EMEA. She does not own any crypto.