48 billion won of fraud and one BTS member later, suspected hacking group...

BTS member Jungkook poses for a photo in Gangnam, southern Seoul, on Feb. 12. [JOINT PRESS CORPS]

A suspected mastermind of an overseas hacking syndicate that stole more than 48 billion won ($31.9 million) from dozens of victims, including an attempt to access BTS member Jungkook's securities account for HYBE shares, was arrested by police, the Seoul Metropolitan Police Agency said Thursday.

The suspect, a Chinese national who allegedly siphoned the money through SIM cloning and fraudulent mobile activations, has been in custody since last Friday.

Authorities said the suspect has been charged with 18 offenses, including computer fraud and violations of communications privacy law.

He was extradited to Korea on May 13. He is expected to be referred to the prosecutor on Friday.

Another suspected ringleader of the same crime — who had already been extradited and formally handed over to prosecutors in August of last year — faces an additional charge of SIM cloning.

The syndicate targeted celebrities, wealthy figures and individuals whose losses were unlikely to be detected or addressed promptly, including prisoners, military service members and deceased individuals, the investigator said.

A telegram chat between the crime syndicate members [SEOUL METROPOLITAN POLICE AGENCY]

The syndicate defrauded 28 of 271 targeted victims of 48.4 billion won.

Jungkook of BTS was also targeted. His securities account was allegedly used without authorization in an attempt to steal HYBE shares worth about 8.4 billion won. However, the theft attempt was prevented as authorities timely detected the irregularities and froze the transactions.

Among the confirmed victims were 10 high-ranking corporate executives, as well as three celebrities and influencers and three cryptocurrency investors.

Three victims were linked to companies within Korea’s top 100 conglomerates.

Police said the group’s methods evolved in two stages: SIM cloning and fraudulent SIM activations.

The earlier SIM-cloning operation ran from May 2022 through June 2024. Investigators said the suspects copied 13 victims’ unique SIM authentication data onto blank SIM cards, creating so-called twin SIMs. The scammers allegedly stole 8.9 billion won in cryptocurrency from four victims using this method.

AI-generated image showing a person attempts to hack and steal others' identities [JOONGANG ILBO]

Once telecommunications providers tightened security measures, the SIM cloning method became unavailable.

The fraudsters then exploited fraudulent SIM activations between July 2023 and April of last year. They hacked more than 10 non-face-to-face mobile activation sites operated by budget telecom carriers and opened 122 SIM cards under the names of 92 people.

The suspects also breached more than 10 public and private platforms to illegally access the financial information of 195 individuals and obtain authentication credentials. The group allegedly stole 39.5 billion won from 24 victims through the advanced scheme, with one victim suffering losses of 21.3 billion won. The scammers’ attempt to steal another 25 billion won was thwarted.

Investigators described the organization as a tightly structured criminal enterprise in which responsibilities were divided among managers, operatives and money-laundering specialists under two leaders who oversaw the hacking operations.

Police said the two

ringleaders had known each other since their school days. The other 30 members reportedly had various backgrounds, including unemployed individuals, self-employed workers and university students.

During the investigation, police froze accounts containing 12.8 billion won and helped recover about 21.3 billion won through various measures, including suspicious transaction detection systems at financial institutions.

The police had mobilized 55 investigators for 3 years and 11 months.

“This case involves a new type of crime that is difficult to find precedents globally,” the police said. “We will continue the investigation in cooperation with the International Criminal Police Organization, or Interpol, and do everything possible not only to apprehend suspects but also to trace and recover criminal proceeds.”

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.