South Korean intelligence says North Korean hackers possibly behind Coincheck heist: sources

SEOUL (Reuters) - South Korea’s intelligence agency told lawmakers North Korean hackers could have been behind the $530 million theft of virtual coins from a Japanese cryptocurrency exchange last month, people familiar with the matter told Reuters on Tuesday.

The people, who had knowledge of parliament’s intelligence committee proceedings, told Reuters the National Intelligence Service did not present evidence that North Korean hackers were responsible for one of the largest cryptocurrency heists in history but flagged it as a possibility.

Local media earlier on Tuesday reported the spy agency told the intelligence committee North Korean hackers had “probably” hacked into the Tokyo-based exchange.

One of the people who spoke to Reuters said that the spy agency said “it’s a possibility that North Korea was behind the theft.”

The person said the virtual coin market remains a likely target for North Korean hackers due to its sheer size and light regulation but that there was no firm evidence the North was responsible.

Last month, Coincheck, one of Japan’s biggest cryptocurrency exchanges, said it had about 58 billion yen ($530 million) worth of NEM virtual coins stolen and that it would return 46.3 billion yen to investors who had lost funds.

The other person who spoke to Reuters said “it’s possible, but not a probable scenario backed by evidence” that North Korea was behind the theft.

Both people Reuters spoke to declined to be named due to the sensitivity of the issue. A spokesperson with the NIS declined to comment.

The reports have reignited speculation Pyongyang could be unleashing cyberattacks once again. The U.S. has publicly blamed North Korea for launching the so-called WannaCry cyberattack that crippled hospitals, banks and other companies across the globe in 2017.

A South Korean lawmaker on Monday said North Koreans were responsible for billions lost in theft from local cryptocurrency exchanges in 2017.

“North Korea sent emails that could hack into cryptocurrency exchanges and their customers’ private information and stole (cryptocurrency) worth billions of won,” Kim Byung-kee, a member of South Korea’s parliamentary intelligence committee, said on Monday.

Kim did not disclose which exchanges were hacked.

The reports also come as Japan rushes to clean up cryptocurrency markets after the Coincheck theft.

Japanese authorities on Friday swooped on Coincheck with surprise checks of its systems and said it had asked the exchange to fix flaws in its computer networks well before the theft.

Japan’s top government spokesman, Chief Cabinet Secretary Yoshihide Suga, said on Tuesday Japan gathers and analyses information on North Korea’s cyberattack capabilities but declined to comment on specific analysis.

“We acknowledge how we deal with cyber attack is an important issue for our nation’s security, crisis management and the economic growth,” Suga told reporters in his regular morning presser. “We would like to respond in cooperation with the international community with a sense of urgency.”

($1 = 1,093.1300 won)