North Korea’s state-sponsored hackers have been attributed to six of nine major attacks on South Korean crypto exchanges since 2018, with confirmed theft exceeding $120 million, according to a new report from Crystal Intelligence. The 2026 South Korea Country Assessment Report also identifies $7.1 billion in illegal crypto transactions between 2021 and August 2025.
Of the $7.1 billion in identified illegal transactions, $6.4 billion is linked to a single cross-border laundering method known as Hwanchigi. Hwanchigi works by converting funds into cryptocurrency offshore, routing them through domestic exchanges, and cashing out in South Korean won — a method that is difficult to detect without cross-chain tracing capability. Combined estimated losses from all nine exchange incidents between 2017 and 2025 reach $196 million to $225 million. The most recent, a November 2025 attack on a major domestic exchange worth $30.4 million, remains under investigation.
The report documents a sharp rise in crypto-enabled fraud targeting South Korean citizens. Pig-butchering investment scams cost victims $70.6 million in 2025, a 48% year-on-year increase across 1,565 reported incidents. Approximately 1,000 South Koreans are detained in scam compounds across Cambodia, Myanmar, and Laos, with 73 nationals repatriated from a single deepfake-driven fraud network in January 2026.
South Korea’s regulatory response has been aggressive. All virtual asset service providers must register with the Korea Financial Intelligence Unit (KoFIU) and maintain real-name verified accounts linked to domestic banks — among the strictest requirements in Asia. In March 2026, KoFIU issued its largest ever enforcement action against a domestic exchange — a $24.6 million fine and six-month partial suspension for 6.65 million anti-money laundering violations. The suspension was subsequently overturned by Seoul Administrative Court in May 2026.
Despite tightened oversight, Crystal Intelligence’s original scan of 247 peer-to-peer advertisements across four platforms in March 2026 shows where unregulated activity persists. Foreign domestic payment systems appear as settlement methods — introducing a cross-border payment layer that sits outside South Korea’s real-name verification system and complicates transaction traceability for compliance teams. A privacy-focused cryptocurrency is also present, an asset the report flags as carrying elevated money laundering risk.
“South Korea is one of the most important crypto markets in Asia and one of the most complex to navigate. This report gives compliance teams, law enforcement, and VASPs the verified intelligence they need to operate with confidence,” said Navin Gupta, CEO, Crystal Intelligence.
The full report is available at crystalintelligence.com/resources/south-korea-report.
About Crystal Intelligence
Crystal Intelligence provides blockchain intelligence solutions for financial institutions, law enforcement agencies, virtual asset service providers, and regulators. The company’s platform enables organizations to detect crypto fraud, trace digital funds across over 330 blockchains, and maintain regulatory compliance. The company is ISO 27001 and GDPR compliant. For more information, visit crystalintelligence.com.
Media Contact
Lesia Klochai
PR & Communications
press@crystalintelligence.com
