South Korean authorities suspect that the North Korean hacker group Lazarus is behind yesterday's Upbit hacking incident.

According to a report by the Korean Central News Agency on November 28, regarding the theft of virtual assets worth 44.5 billion won (with official data from Upbit stating 54 billion won) from South Korea's largest virtual asset exchange Upbit, authorities are focusing their suspicions on the hacker organization Lazarus, which is under the North Korean Reconnaissance General Bureau.

The attack occurred in the hot wallet and used the same method as the 58 billion won Ethereum theft case from Upbit in 2019. Government officials stated that the attackers may have transferred funds by stealing administrator accounts or impersonating administrators.

Security experts point out that hackers transfer funds to other exchange wallets and perform coin mixing operations after an attack, which is a typical tactic of the Lazarus organization. Since countries that have joined the Financial Action Task Force cannot perform coin mixing operations, the likelihood of North Korea being involved in the crime is higher.

It is worth noting that this incident coincidentally occurred on the day of the press conference regarding the merger of Naver Financial and Dunamu. Experts believe this may reflect the bragging mentality of hackers. Currently, institutions such as the Financial Supervisory Service and the Korea Internet & Security Agency are conducting on-site inspections of Upbit.