Science & Tech · Cybersecurity · 4 hrs ago
South Korea faces growing cyber and foreign espionage threats
South Korea is facing cyberattacks and foreign espionage that threaten state secrets and private assets.
North Korean hacking groups have been linked to major cryptocurrency thefts, including attacks on South Korean exchange Upbit and global exchange Binance.
The article says money stolen by North Korea is believed to support its nuclear and missile programmes.
Other cases include people caught photographing South Korean military bases and alleged theft of semiconductor technology for a Chinese competitor.
South Korea’s response has faced criticism because investigators took years to officially link one Upbit attack to North Korea, while a revised law still leaves prosecutors with the challenge of proving espionage and foreign links.
Information sharing with allies is also a concern, after some US sharing was limited and South Korea’s intelligence agency did not attend a regional meeting on North Korean cyber threats.
The proposed response is closer cooperation among South Korean intelligence, police and military agencies, as well as with private firms, and more cyber counterintelligence staff.
The article says these steps are needed to detect threats before damage is done.
South Korea faces cyberattacks and foreign espionage involving North Korean hacking groups and suspected Chinese activity.
A hacking group linked to North Korea was identified by the FBI as the likely perpetrator of a roughly $6.3 billion cryptocurrency theft from Binance.
South Korean authorities have also reported repeated unauthorized photography of military facilities by Chinese nationals and alleged technology theft involving a Chinese competitor.
The article says South Korea’s counterintelligence response faces challenges, including delays in publicly attributing attacks and difficulties proving espionage.
It calls for stronger cooperation among security agencies, private companies and allied countries.
- Who
- South Korea, which faces threats attributed to North Korean hacking groups and suspected foreign espionage.
- What
- The article describes cryptocurrency theft, cyberattacks and suspected espionage and technology theft.
- When
- The article was published on November 3, 2026; it also describes incidents dating back to 2019.
- Where
- South Korea, including military facilities in Suwon and Osan; the article also discusses attacks on the Upbit and Binance exchanges.
- Why
- The article says North Korean hacking proceeds are believed to support nuclear and missile development. It also describes efforts to obtain military and industrial information.
North Korea
FBI
Attribution of the Binance theft
North Korea
The FBI identified North Korean hacking group TraderTraitor as responsible.
FBI
North Korea denied involvement.
About 58 billion won worth of Ethereum was stolen from South Korean exchange Upbit.
South Korea’s National Intelligence Service reported 11 cases of Chinese nationals taking unauthorized photographs of military facilities.
Upbit was robbed of cryptocurrency worth 44.5 billion won, with Lazarus cited as a likely perpetrator.
About $6.3 billion in cryptocurrency was stolen from Binance, and the FBI identified North Korean group TraderTraitor as responsible.
A revised criminal code took effect, allowing espionage for a foreign country or equivalent organization to be punished by at least three years in prison.
- Upbit theft, 2019
- 58 billion won worth of Ethereum
- Upbit theft, 2025
- 44.5 billion won worth of cryptocurrency
- Binance theft
- About $6.3 billion; most of the assets were taken in about 20 minutes
- Chinese photography cases
- 11 cases reported from June 2024 over 10 months
- Military facilities
- Suwon and Osan
- Revised criminal code
- Took effect in September 2026