korea

According to on-chain analyst Specter, North Korea is laundering funds across multiple chains, including underlying chains such as dYdX, Noble, and Osmosis, and has opened perpetual contract positions on dYdX.

Goldman Sachs Global Investment Research Department's South Korea stock analyst Chris Cha stated in a report on September 23 that KOSPI has the conditions for a short-term tactical breakout, but the continuous flow of liquidity from South Korean retail investors into the cryptocurrency market will make the index's subsequent upward movement more reliant on foreign capital and local institutions reconfiguring. The report noted that concerns about the Federal Reserve's interest rates have been partially digested by the market, and risk appetite has shifted towards proxy AI themes.The report pointed out that South Korean memory chips provide fundamental support, with fourth-quarter DRAM contract prices expected to grow double digits quarter-on-quarter, and the ramp-up of HBM4 capacity will continue to limit the supply of standard server DRAM. Samsung Electronics' large shareholder returns, continuous buying by institutions, and foreign capital turning into net buying may drive KOSPI towards the resistance zone of 7000 to 7200 points.The report also indicated that the capacity of local South Korean retail investors to absorb has weakened. After Bitcoin returned to $85,000, cryptocurrency trading in South Korea has heated up. According to DefiLlama data cited in the report, Upbit's single-day spot trading volume on June 13 was approximately $770 million, which rose to $1.817 billion on September 22, an increase of about 136%. Based on the total trading volume of $3.27 billion on that day across South Korea's five major trading platforms, Upbit alone accounted for over half. Goldman Sachs believes this will make KOSPI more reliant on foreign and institutional buying in the future, and October is a critical window to test whether foreign capital will continue to increase its investment in South Korean semiconductor and AI assets.

According to the official announcement, the South Korean cryptocurrency exchange Bithumb will launch the PYUSD token on the Korean won market, with trading expected to open at 15:00 local time.

Stablecoin issuer Circle is hiring a "Senior Director, Ecosystem Growth, South Korea" in South Korea, responsible for developing market entry strategies, tracking regulatory dynamics, and establishing partnerships within the domestic financial and digital asset industry.The position requires candidates to have over 13 years of business development experience, familiarity with stablecoins, DeFi, and institutional financial liquidity, and fluency in both Korean and English. Circle previously stated that its strategy in South Korea is not to directly issue a Korean won stablecoin, but to collaborate with local Korean won stablecoin issuers to provide infrastructure connecting to the US dollar stablecoin.

According to Digital Asset, Yoon Jong-joon, the digital financial policy officer of the Financial Services Commission (FSC) of South Korea, stated that they are considering introducing a market maker system for the virtual asset market to enhance market efficiency and stability. Although the current "Virtual Asset User Protection Act" prohibits market-making activities, this move indicates that the FSC intends to revisit and consider the introduction of this mechanism in the second phase of the legislative process.Yoon Jong-joon also mentioned that exchanges need to have sufficient capital and operational capabilities, and core functions (such as transaction execution, trading support, and abnormal trading monitoring) may shift from self-regulatory oversight to public regulation; governance rules related to major shareholders and management are expected to be strengthened; after the bill is enacted, it is expected to promote business diversification, the establishment of a trustworthy trading environment, a digital asset issuance and disclosure system, a Korean won stablecoin, and enhanced user protection, among other things.

GoPlus Security posted on platform X that the outflow of funds from THORChain needs to be actively signed by validators through TSS threshold signatures, which is different from Bitcoin and Ethereum; approximately 101.5 BTC (about 8.5 million USD) has already been transferred from the stolen funds on Bitget, and about 27.63 million XRP (about 43 million USD) is being exchanged for BTC, calling for interception of North Korea-related addresses.

According to the Financial Times, the South Korean Deputy Prime Minister recently stated, "Artificial intelligence should be regarded as a fundamental infrastructure like 'electricity,' and every South Korean citizen should be able to use it affordably without worrying about costs." Last year, South Korean President Lee Jae-myung stated that this technology has brought South Korea to "a significant historical turning point," and asked, "Are we going to continue to act as followers who may be left behind, or become leaders who can seize unlimited opportunities?" To answer this question, the government last month selected domestic telecom companies SK Telecom and KT, as well as internet service provider Kakao, to lead the implementation of the "Universal Artificial Intelligence" plan, aimed at allowing South Korea's 51.6 million citizens to use services similar to ChatGPT and personal AI assistants for free. The South Korean Deputy Prime Minister clearly stated on social media that despite concerns that technology may spiral out of control and lead to catastrophic consequences, South Korea remains determined to become "one of the top three countries in artificial intelligence." He wrote, "Currently, we have no room to slow down the pace of artificial intelligence development. We will accelerate, but we will do so more safely."

Recently, there has been a significant price deviation of fiat currency-pegged stablecoins in South Korean virtual asset exchanges. The Japanese yen stablecoin JPYC surged to four times its benchmark price after its listing, the euro stablecoin EURC skyrocketed over 400% in a single day on Bithumb, and the US dollar stablecoin PYUSD also showed a noticeable premium.Analysis suggests that the aforementioned fluctuations are due to insufficient circulation in the early listing phase combined with concentrated buying, unrelated to the issuer's asset preparation. Industry experts point out that relying solely on reserves cannot prevent price distortions in the secondary market, calling for the establishment of initial circulation guarantees, market maker (MM) and liquidity provider (LP) mechanisms during the design phase of the original Korean won stablecoin system, as well as the introduction of measures such as public disclosure of price deviation rates and restrictions on market orders.

According to Catcher Predict monitoring, in the market prediction on Polymarket for the event "Korean Open: Katie Volynets vs. Kimberly Birrell," the "Over" option for the sub-market "Korean Open: Katie Volynets vs. Kimberly Birrell total games greater than 23.5" has experienced a significant fluctuation in winning probability, soaring from 50% an hour ago to the current 76% (a fluctuation of 26%). Please note the impact of related breaking news.

According to on-chain detective Specter, by tracking on-chain fund flows, the North Korean hacker organization Lazarus Group may be the behind-the-scenes attacker of the Bitget theft incident. This incident is linked to the AFX attack that occurred in July this year, which resulted in losses of approximately 24 million dollars and was attributed to TraderTraitor associated with Lazarus Group.The stolen XRP from Bitget, after cross-chain transfer, can be directly linked to the stolen funds in the AFX attack.

Bitget CEO Gracy Chen stated during a live Q&A on platform security incidents that preliminary investigations found that some related IP addresses matched a VPN service used by a North Korean hacker organization, and the attack patterns were similar to previous actions by North Korean hackers. Therefore, the involvement of this organization in the attack, which involves approximately $351.6 million, cannot be ruled out. The relevant attribution is still in the preliminary investigation stage.Gracy Chen indicated that Bitget currently does not believe this incident was caused by internal personnel. The attackers directly infiltrated the platform's system and transferred funds, without forging user withdrawal requests, and did not obtain the private keys of cold wallets or hot wallets. Investigators are still confirming the specific affected systems and the method of the attackers' intrusion.

The Bank of Korea (BOK) has launched the first 24-hour Korean won settlement network pilot, aimed at allowing foreign investors to settle won transactions outside of normal banking hours in South Korea. The central bank announced on Monday that its international wire transfer network has begun trial operations with four domestic banks: KB Kookmin Bank, Woori Bank, Hana Bank, and Shinhan Bank. Full operations are expected to start in January 2027, at which point participation will expand to other institutions and foreign banks.The network operates 24 hours a day on weekdays, excluding weekends and public holidays. Foreign investors can settle won transactions during their domestic business hours by registering a Foreign Institution (RFI-K) account for won services, without the need to open an account directly with a South Korean financial institution. The Bank of Korea stated that the network is expected to enhance the international status of the won by improving foreign investors' access to won settlement infrastructure.In addition, the Bank of Korea is also experimenting with tokenized settlement infrastructure through the Agorá project led by the Bank for International Settlements, which completed a cross-border payment trial using tokenized central bank reserves and commercial bank deposits, including the won, in July. The Bank of Korea is simultaneously advancing the Hangang project, a blockchain-based pilot that utilizes wholesale central bank digital currency to settle tokenized commercial bank deposits.

The North Korean hacker group WaterPlum disguises itself as a cryptocurrency, AI, and NFT company recruiter, deploying malware disguised as programming tasks or video conference repair files to software developers and IT professionals.The organization has infected at least 30,000 devices in over 100 countries and extracted funds or account credentials from more than 7,000 cryptocurrency wallets between December 2025 and July 2026, stealing at least $10.7 million.

According to Forbes, a warning jointly issued by multiple agencies including the Federal Bureau of Investigation (FBI) and the National Police Agency (NPA) of Japan indicates that the North Korea-linked hacker group WaterPlum (also known as Contagious Interview) will launch attacks on global IT developers from December 2025 to July 2026 by disguising itself as companies in the AI, cryptocurrency, or NFT sectors and offering fake job positions.Attackers contact job seekers on social media and recruitment platforms, luring them into downloading malicious files under the pretext of technical interviews or programming tests. They successfully infected over 30,000 devices, covering more than 100 countries and regions, and stole data from over 7,000 cryptocurrency wallets. Related funds of at least $10.71 million have flowed into wallets controlled by the attackers.

The Cyber Investigation Department of the Gangwon Special Self-Governing Province Police Agency in South Korea has identified 26 Polymarket users by analyzing public blockchain transaction records and on-chain open-source intelligence, and has filed cases against them for suspected illegal gambling. Among them, 18 have been referred to the prosecution, with a total bet amount of 12.7 million USD, and the highest single user bet reaching 4.1 million USD.The police launched a preliminary investigation in March and began filing cases against the involved individuals in May; the South Korean Communications Commission only ordered the blocking of Polymarket on August 18, and the transactions under investigation occurred while the platform was still accessible. The police are advancing the investigation based on Article 246 of the South Korean Criminal Code.

According to MLM monitoring, DRV experienced unusual activity on Upbit, with a rapid increase of 300% within 10 minutes, briefly reaching 1600 Korean Won (approximately 1.15 USD), but then subsequently fell back.

According to a joint alert issued by the Japanese National Police Agency, FBI, ASD/ACSC, BND, and BfV, the North Korean-backed cyber attack organization "WaterPlum" (also known as Contagious Interview) targets job seekers by disguising itself as an AI, cryptocurrency, and NFT company to post fake job listings. This lures job seekers into downloading NPM packages containing malware such as BeaverTail, InvisibleFerret, and OtterCookie, which then steal cryptocurrency wallet information and confidential data.As of July 2026, the organization has infected over 30,000 devices in more than 100 countries and regions worldwide, stealing information from over 7,000 cryptocurrency wallets, with the wallets under its control receiving at least approximately 1.7 billion yen (about 10.71 million USD) in cryptocurrency. The Japanese National Police Agency has discovered and dismantled a "notebook farm" established by local "supporters" for the first time in the country, where North Korean IT laborers remotely control PCs within the supporters' residences to conduct business, with the related amount involved reaching several hundred million yen.The police and FBI assess that WaterPlum and some North Korean IT laborers are under the unified command of the 313 Bureau of the Ministry of Military Industry of the Workers' Party of Korea, with the profits directly flowing into North Korea's national funding pool. The police remind IT technicians and corporate issuers to remain vigilant and avoid executing third-party code in unverified environments.

According to Cointelegraph, a report by Chainalysis shows that in the past 12 months, the number of times attackers stored malware instructions or infrastructure information on public blockchains has surged by 420%, with state-sponsored hackers contributing about two-thirds of the new activity each quarter. Chainalysis linked previously unattributed activities on Tron, Aptos, and BNB Smart Chain to the North Korean-backed organization UNC5342.The report points out that the encoded pointers in Tron and Aptos transactions direct infected devices to the same BSC transaction, which contains encrypted server addresses and configuration data used to connect to remote access and data theft infrastructure. Information on public blockchains remains accessible even after domain names, servers, or code repositories are shut down, enhancing the persistence of malware activities. In 2025, North Korean hackers used similar technology called EtherHiding to implant coin theft code into smart contracts.Additionally, since July 2025, the volume of malicious blockchain writes has increased by 440%, when high-capacity open-source Chinese AI models began to have the ability to generate malicious code. Eric Jardine, head of cybercrime research at Chainalysis, stated that a clear temporal correlation was found, but it could not be proven that the attackers used these models.Chainalysis also identified threat actors suspected of being linked to the Iranian Ministry of Intelligence, writing encoded command and control routing data into the Bitcoin blockchain and sending small payments to well-known addresses historically associated with Satoshi Nakamoto, which are unrelated to the attackers and serve only as a permanent public location for infected devices to receive update instructions.

According to data submitted by the Korean National Police Agency to Democratic Party member Yoon Kyun-young's office, as of September 15, the Gangwon Provincial Police Agency's Cyber Investigation Team has initiated investigations into 26 Polymarket users, with 18 of them referred to the prosecution. The total betting amount involved is approximately 17.6 billion Korean won, with the highest individual bet being around 5.7 billion Korean won. The police believe that the trading activities on Polymarket clearly constitute illegal gambling.The Korean authorities identified and tracked these users by analyzing publicly available blockchain transaction records using open-source intelligence technology. The Korea Communications Standards Commission decided to block Polymarket on August 18. The KCSC determined that the platform's betting on uncontrollable events and its "winner takes all" profit model fostered a gambling mentality.