[In&Out] A precarious counterintelligence network that is ‘opened and robbed’

On November 27, 2019, 58 billion won worth of Ethereum was withdrawn from Upbit, Korea's largest virtual asset exchange, at the market price at the time. The investigation revealed that it was the work of 'Lazarus', a hacking organization under the North Korean Reconnaissance General Bureau. Six years later, on the same day in 2025, Upbit lost another 44.5 billion won. This time too, Lazarus was mentioned as the likely mastermind. It was a robbery carried out without even appearing on the scene. We live in an era where hacking organizations under the command of the state are attacking financial networks.

While spies in the Cold War era recruited people to steal documents, in the digital age, they infiltrate information networks through hacking. North Korea has been training so-called IT (information technology) warriors since the 1990s. They expanded their focus from information to assets following the hacking of the Bangladesh Central Bank in 2016. On the 29th of last month, about $6.3 billion (about 8.4 trillion won) in virtual assets were stolen from Binance, the world's largest virtual asset exchange. It took only about 20 minutes to steal most of the assets. It is the largest single hack in history. The U.S. Federal Bureau of Investigation (FBI) identified the North Korean hacking organization 'Trader Trader' as the mastermind. This is an organization linked to Lazarus, which attacked Upbit. North Korea denied any involvement. The money North Korea steals through hacking should be seen as being used to fund nuclear and missile development.

Spies don't just come from North Korea. Last year, two Chinese teenagers were caught filming military bases in Suwon and Osan. The teen's father is said to be a Chinese police officer. They were caught again doing the same thing two days after being released. The National Intelligence Service reported to the National Assembly that 11 cases of unauthorized filming of military facilities by Chinese citizens were detected over a 10-month period starting from June 2024. Last month, three former employees of the victim company were put on trial on charges of leaking 'probe card' technology, a key semiconductor inspection equipment, to Chinese competitors. The former executive accused of leading the crime fled to China.

The problem is our counterintelligence capabilities. The FBI identified North Korea as the mastermind two days after the Binance hack. On the other hand, it was five years after the incident that the South Korean police officially announced the North Korean link to the Upbit hacking in 2019. There is a difference between judging the initial information and announcing the final investigation results, but the difference in skill is felt in tracking the background. There were also legal limits. A representative case is one in which a military official belonging to the Armed Forces Intelligence Command received money from a person presumed to be a Chinese intelligence agent and handed over military secrets, including a list of overseas 'black agents'. He was sentenced to 20 years in prison, but the crime was general transfer under the Military Criminal Act. Espionage charges were excluded from the prosecution stage. This is because the connection with North Korea has not been proven. The revised criminal law that went into effect last September made espionage for foreign countries or similar organizations punishable by imprisonment for at least three years. However, the difficulty of proving links to foreign countries and espionage still remains.

As the new Cold War in Northeast Asia deepens, information sharing with allies becomes more important. The United States' recent restrictions on sharing information on North Korea, and the National Intelligence Service's absence from the Korea-U.S.-Japan meeting last June to respond to North Korean cyber threats, are not matters to be taken lightly. The National Intelligence Service's position is that there is no problem with overall intelligence cooperation, but this should not lead to distrust between allies. The private sector, such as exchanges and financial institutions, is also the forefront of counterintelligence. We must strengthen cooperation between the National Intelligence Service, police, and military counterintelligence agencies, while expanding cooperation with the private sector and increasing cyber counterintelligence personnel. It is too late to close the door after it has been breached and robbed. Counterintelligence networks work best when they are one step ahead of the threat.