Bitcoin Magazine

U.S. Treasury Sanctions Crypto Launderers Behind North Korea’s Fake Workers

The U.S. Treasury Department on Tuesday sanctioned ten individuals and one company, accusing them of helping North Korea collect wages from foreign employers, many of them American, through fake identities and forged paperwork.

The workers are typically placed at legitimate firms under invented personas, sometimes with AI-generated resumes, doctored photos, or deepfake video during interviews. 

Most of their pay goes back to the regime, which Treasury says uses the money to fund its weapons of mass destruction and ballistic missile programs. Some of these workers have also gained access to corporate networks, where they have planted malware and taken proprietary data.

The money and crypto behind North Korean fraud

The sanctions focused less on the workers themselves than on the people who move the money. Two Russian nationals are at the center of the action. 

Vitold Obertas, described by Treasury as a go-between for North Korean financial transactions, allegedly handled nearly $2 million in crypto conversions and at least $1.25 million in other currency transfers for North Korean officials since January 2025. 

Ilya Boykov allegedly converted the equivalent of $3.5 million in crypto for Alis, a North Korean IT worker company that the U.S. sanctioned in 2024.

Two North Korean nationals, Kim Ki Hyok and Kim Hyo Dong, were also named for leading Russia-based worker delegations. Kim Ki Hyok has reportedly moved close to $500,000 in crypto for his team since 2024. 

Treasury also sanctioned the First Financial and Technical Development Center, a North Korean-controlled entity operating in Russia, along with six workers who have generated more than $750,000 for it since 2025.

Treasury published wallet addresses on Ethereum and Tron tied to the sanctioned individuals, a signal to exchanges and other financial firms to watch for those accounts. One Ethereum address is linked to both Obertas and Boykov.

The action follows a March designation of a separate North Korean IT worker network, which Treasury said had laundered roughly $800 million in crypto for the regime. Australia and the European Union have also announced related designations this month, and Treasury coordinated the move with the Multilateral Sanctions Monitoring Team.

Under the sanctions, any property these individuals or entities hold in the United States, or that is controlled by U.S. persons, is blocked and must be reported to the Office of Foreign Assets Control. Transactions with them are generally prohibited unless licensed, and companies owned 50 percent or more by blocked parties are subject to the same restrictions. Treasury warned that civil penalties can apply even when a violation was unintentional.

For companies that hire remote contractors, the advisories from the State, Treasury and Justice departments and the FBI offer guidance on spotting these schemes, including verifying identities, checking where payments are going, and watching for unusual access requests.

This post U.S. Treasury Sanctions Crypto Launderers Behind North Korea’s Fake Workers first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

South Korean prosecutors have raided cryptocurrency exchange Bithumb’s headquarters as part of an ongoing investigation into allegations that former and current executives misused company funds allocated for luxury housing. According to an October 29 report by local media outlet News1…

North Korea launched what may have been a ballistic missile at about 12:36 p.m. local time on Oct. 29, and it is presumed to have fallen near the east coast of the Korean Peninsula without reaching Japan’s territory or exclusive economic zone, Japan’s Ministry of Defense said on social media. Tokyo said Japan, the United […]

Bitcoin Magazine

Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures

Crypto hacks have produced roughly $2.35 billion in net losses so far in 2026 after freezes and returns, according to a report by Lightning.news shared with Bitcoin Magazine. A security researcher by the name of Stacy Muur posted on X compiled “a list of protocols that were hacked for more than $50,000 in 2026.” 230 protocols year-to-date. “Crypto security is absolutely cooked.” September alone accounted for about $768 million in Muur’s tally, driven mainly by centralized exchanges and DeFi rather than pure Bitcoin self-custody hardware wallets, which got significant news coverage at the time.

The largest single loss was Bitget’s September 24 drain of roughly $387.5 million from hot and warm wallets. The exchange and firms including Chainalysis, Elliptic, and TRM Labs have linked the incident to North Korea, citing IP patterns consistent with prior DPRK-linked VPN use, on-chain overlaps with wallets tied to earlier Lazarus Group and TraderTraitor activity, including the 2025 Bybit theft. Attackers used third-party security products to inject fraudulent withdrawal commands without taking private keys.

Liquid Network, Blockstream’s Bitcoin sidechain, took the next-largest hit when attackers exploited an Elements software bug in early September to mint about 4,000 unbacked L-BTC and peg them out for roughly 4,000 real bitcoins, valued near $320 million at the time. The self-described white-hat actors returned 3,400 BTC after negotiations conducted on-chain via OP_RETURN messages and kept about 600 BTC. No federation keys were compromised. The loss came from a type of inflation bug on the Liquid network protocol. 

Samson Mow later called the episode part of an “avalanche of AI-assisted attacks” that had already reached other Bitcoin-adjacent software before hitting Liquid. The network is back and running now, having covered the losses, presumably from investors. 

DeFi platforms showed the same pattern of concentrated, high-value losses. Drift Protocol lost approximately $285–296 million in an April governance and multisig compromise that involved months of social engineering. An investigation commissioned by the project attributed the operation to North Korean actors. 

KelpDAO’s LayerZero-powered rsETH bridge was drained of roughly $292 million in unbacked tokens after a single-verifier design was subverted. LayerZero stated that preliminary indicators pointed to DPRK’s Lazarus Group, specifically TraderTraitor. 

Tectonic on Cronos saw about $120.4 million borrowed against manipulated collateral in late August. Validators later rewound the chain and recovered the majority, though several million dollars that had already been bridged off-network were not restored.

Incidents involving Bitcoin hardware wallets were smaller in aggregate despite the wide news coverage. Galaxy Research placed the Coinkite RNG hack values in the range of roughly 1,596–1,789 BTC, on the order of $100–130 million, with higher upper-bound estimates near 2,055 BTC. 

Ledger losses of roughly $86–102 million traced to devices sold through the authorized Southeast Asian reseller CryptoBilis, where an unauthorized hardware implant captured recovery phrases during setup, a supply chain attack. The company stated that confirmed cases were limited to that reseller’s supply chain and that its own systems and direct sales were unaffected, though there are unconfirmed reports of such bugged devices making it to German markets. Combined, however, these hardware-adjacent events remain well below the single largest CEX and DeFi incidents. 

The year has also coincided with the practical deployment of AI coding agents capable of scanning codebases for vulnerabilities and automating exploit development. Muur has stated that “AI is definitely making it much easier to find and exploit bugs. I think we’re entering a pretty serious cybersecurity arms race.” 

Reports note that code-flaw exploits accelerated after the February release of models such as GPT-5.3-Codex and Claude Opus 4.6, which showed high success rates on smart-contract bug benchmarks at low cost. 

OpenAI has disclosed internal testing cases in which agents accessed unauthorized test-network funds or bypassed controls to complete tasks. Most of the year’s largest heists still relied on traditional vectors such as key compromise, social engineering, and infrastructure flaws, but the lowered barrier for discovering and weaponizing bugs adds a new layer of risk, particularly for complex smart-contract systems and sidechains.

Bitcoin’s base layer itself has not been the source of these losses. The bulk of the 2026 damage has concentrated in CEX hot-wallet infrastructure, DeFi governance, oracle designs, and Bitcoin sidechain code, while pure self-custody hardware wallets, even when imperfect, have accounted for a distinctly smaller share. Nevertheless, calls for an update to self custody recommendations have emerged from industry leaders, pushing forward multivendor multisig wallets as the future of niche industry.

This post Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet Failures first appeared on Bitcoin Magazine and is written by Juan Galt.

South Korean officials are discussing another postponement of the crypto income tax scheduled for January 1. The presidential office has signalled support for moving the start to 2029, but the National Assembly has not passed that change. For a trader,…

Japan's GMO Internet is verifying alleged customer data posted by suspected hackers following a cloud service breach.

South Korea has begun considering a new education tax on cryptocurrency exchanges that could leave major operators such as Upbit and Bithumb paying billions of won annually if they are reclassified as financial businesses under the proposed Digital Asset Basic…

Bitcoin Magazine

South Korea Weighs Fourth Delay of Crypto Tax, With 2029 Start Tied to U.S. Data Sharing

South Korea’s presidential office is reviewing a fourth postponement of the country’s 22% tax on crypto gains, with a 2029 start date gaining support among lawmakers and industry groups.

The tax is scheduled to take effect January 1, 2027. The presidential office said it is in talks with government agencies about a delay, citing gaps in the regulatory framework and the problem of treating domestic and overseas trades the same way, according to Newsis reporting.

The levy dates to a 2020 amendment to the Income Tax Act. It applies a 20% national rate plus a 2% local rate to annual income from the transfer or lending of virtual assets above a 2.5 million won ($1,888) deduction. The start date was set for 2022, then pushed to 2023, 2025 and 2027 as officials conceded that tax systems and investor protections were not ready.

The U.S. data problem

The argument for 2029 rests on the OECD’s Crypto-Asset Reporting Framework, the standard under which tax authorities swap crypto transaction records with one another. South Korea is among the first group of jurisdictions set to begin exchanges in 2027. The United States does not join until 2029.

A presidential office official told Newsis that the absence of U.S. trading data is the biggest bottleneck. Without it, the National Tax Service would have to chase overseas transactions one by one, and Korean traders on domestic exchanges would carry a heavier burden than those on foreign platforms or in self-custody.

On October 16, Democratic Party lawmaker Park Min-gyu and 13 colleagues filed a bill that would push the tax to January 1 of the second year after the first international data exchange, which works out to 2029. People Power Party lawmaker Song Eon-seok filed a separate bill to strike the crypto tax provisions from the law.

The Korea Digital Asset Business Association backed the 2029 date Thursday and asked the government to pass a digital asset law with stock-market-grade investor protections before any tax takes effect.

A tax fight that has been building

The pressure has come from several directions at once. Last week, two public petitions, one to repeal the tax and one to defer it two years, each cleared the 50,000 signatures that force a legislative review. Democratic Party leader Kim Min-seok called for a “thorough final review,” a shift for a party that had held the line on 2027.

Finance Minister Lee Hyeong-il told a parliamentary audit Thursday the government would decide “after carefully considering and gathering all opinions from the industry and the National Assembly.” Financial Services Commission chairman Lee Eog-weon said the same day that the tax should “take various circumstances into full consideration.”

The Virtual Asset User Protection Act took effect in July 2024, but the Digital Asset Basic Act, the licensing framework flagged alongside spot bitcoin ETF approval, has not passed. Lawmakers have questioned taxing a market before the law defining it exists.

The National Tax Service has not slowed down. It plans to publish a draft notice on taxable crypto income by the end of October. The government expects to settle its position through inter-agency talks after audits wrap, with a decision through National Assembly tax revisions between late November and early December.

This post South Korea Weighs Fourth Delay of Crypto Tax, With 2029 Start Tied to U.S. Data Sharing first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

A computer simulation run by South Korean and U.S. forces during this summer’s Ulchi Freedom Shield exercise ended with North Korean troops breaking through allied defensive lines and advancing to the outskirts of Seoul, South Korea’s Chosun Ilbo newspaper said, a result that has deepened a dispute over when Seoul should take wartime command of […]

South Korea is considering delaying its 22% crypto gains tax until 2029, citing overseas trading data gaps and concerns about taxing domestic investors.

Bitcoin Magazine

Bank of Korea Wants Stablecoins Written Into Forex Law as Crypto Bill and Tax Fight Come to a Head

The Bank of Korea plans to draft an amendment to the Foreign Exchange Transactions Act with the government before year-end that would regulate stablecoins as a means of payment, according to a written submission to the National Assembly’s annual audit reported by Korean outlet Digital Asset.

The central bank’s October 22 report, a follow-up to last year’s audit, says it is consulting with the government on measures to regulate cross-border transactions in virtual assets. 

While building a monitoring system based on foreign exchange network reporting, the bank said, it plans to prepare the amendment with the government this year to regulate stablecoins as a means of payment, among other aims.

That is a plan to write a bill, not a bill in itself. There is no draft text, no named token and no passage date. And “means of payment” is a defined term in Korean forex law: an instrument whose cross-border movement must be reported. 

On that reading, the amendment would put dollar stablecoins under the same controls as a wire to New York, not make them legal tender at a Seoul convenience store.

The BOK pointed to settlement outside the banking system, mixers and regulatory gaps around personal wallets as factors that ease illegal transactions. Bitcoin holders who self-custody in Korea should take note: the country’s capital controls are the reason the kimchi premium exists, and a tighter forex net around crypto would entrench those controls rather than ease them.

The forex work runs in parallel with the Digital Asset Basic Act, the licensing and stablecoin-issuance framework flagged alongside spot bitcoin ETF approval in the government’s 2026 growth strategy. 

Financial Services Commission chairman Lee Eog-weon told lawmakers Thursday that consultations are in their final stage and the bill will follow as soon as possible, Bloomingbit reported. 

The BOK said it will work with ministries to limit transactions that exploit the gap until that law exists.

South Korea’s crypto tax discussions

The gap has a date attached. Korea’s crypto income tax is due to take effect January 1, 2027, according to The Block, after three postponements, and lawmakers have questioned taxing a market before the law defining it is passed. 

Lee said Thursday the tax should “take various circumstances into full consideration,” per Yonhap. Democratic Party leader Kim Min-seok called Thursday for a “thorough final review,” a shift from a party that had insisted on 2027. 

Two petitions, one to repeal the tax and one to defer it two years, each cleared the 50,000 signatures that force a legislative review. 

The National Tax Service has not moved: it plans to finalize its draft tax notice by October 30, Digital Asset reported.

This post Bank of Korea Wants Stablecoins Written Into Forex Law as Crypto Bill and Tax Fight Come to a Head first appeared on Bitcoin Magazine and is written by Micah Zimmerman.

South Korea will require registration and reporting for cross-border crypto transfers from December 3, including exchanges and private wallets.

South Korea’s central bank has introduced new reporting requirements that will require domestic crypto exchanges to disclose the monthly holdings of users who have previously transferred digital assets overseas. According to an October 23 report by local media outlet Digital…

The FBI alerted contractors that North Korean IT workers are trying to obtain positions with cleared defense companies and others with government contracts.

© Getty Images/Unya-MT

Sophos found BRONZE SANDCASTLE abusing legitimate Windows apps to load encrypted backdoors, collect system information and steal Active…

South Korea is approaching another decision point on its long-delayed cryptocurrency gains tax, with exchanges and policymakers preparing to discuss whether the January 2027 start date is realistic.

TL;DR: The country’s planned crypto tax has already been deferred three times. A new proposal would push implementation toward 2029, but no additional delay has been enacted.

Finance officials are expected to meet representatives of major domestic exchanges on October 20. The industry is arguing that the systems needed to handle different transaction types and calculate cost bases are still incomplete. A rushed launch, exchanges say, risks creating inconsistent tax treatment or driving activity to offshore platforms.

South Korea’s planned rate is commonly described as 22% after local tax is included, rather than a simple 20% all-in charge. The question now is less about whether crypto gains should ever be taxable than whether the supporting reporting infrastructure is ready for millions of transactions across different venues.

A lawmaker’s proposal would link the effective date to cross-border data sharing through the OECD’s Crypto-Asset Reporting Framework, potentially moving the start to 2029. That measure requires legislative action; a meeting with exchanges cannot, by itself, change the law.

For investors, the current scheduled date remains January 2027 unless lawmakers decide otherwise. For exchanges, a later timetable could buy time to build reporting systems, but another postponement would also prolong policy uncertainty. South Korea has reached this crossroads before, which is why a proposed delay should not be reported as a settled outcome.

Written by the News Desk and edited by Samuel Rae.

TL;DR: South Korea’s Financial Services Commission identified Gopax operator Streami among 16 financial firms affected by recent hacking incidents. Authorities said around 100,000 data-leak cases had been identified across the broader group, not specifically at Gopax.

A South Korean cryptocurrency exchange has been caught up in a cybersecurity investigation stretching across the country’s financial sector.

The Financial Services Commission disclosed on October 14 that hacking incidents had affected 16 financial firms, with around 100,000 cases of leaked data identified across the group. Streami, which operates the Gopax exchange, was among the named businesses, alongside banks and other financial companies.

That figure is important to read correctly. It describes the regulator‘s overall investigation, not 100,000 confirmed Gopax customers or accounts. Public reporting has not established a firm-by-firm breakdown of the total.

The incident has also brought the exchange’s communications under scrutiny. A report by Seoul Economic Daily said Gopax had not issued an apology or detailed public disclosure as of October 15, the day after the regulator’s announcement. That makes a subsequently issued apology a claim that would need its own independently verified notice before publication.

South Korea’s financial watchdog said it would investigate the methods used in the attacks, including whether artificial intelligence played a role. It also signalled broader security inspections and measures to improve detection and coordinated responses.

There is no basis in the regulator’s overall data-leak tally to claim that Gopax suffered a specific amount of stolen cryptocurrency. The confirmed story is about an exchange operator named in a wider financial-sector cyber incident and the pressure for clearer disclosures when customer information may be at risk.

Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.

The post US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms appeared first on SecurityWeek.

Bitcoin Magazine

South Korean Lender Jeonbuk Bank to Offer Bitcoin-Backed Loans

Jeonbuk Bank has become the first bank in South Korea to offer won-denominated loans backed by bitcoin, according to reports. 

The subsidiary of JB Financial Group has started offering the loans, according to exclusive Monday reporting by the country’s Edaily paper. 

For now, the product is limited to corporate customers raising working capital, and bitcoin is the only eligible collateral. The bank said it may expand the service depending on regulatory changes and market demand, the report added. 

JUST IN: South Korea's Jeonbuk Bank will offer the first ever bitcoin-backed won loans for clients pic.twitter.com/jXbIPsejWU

— Bitcoin Magazine (@BitcoinMagazine) October 12, 2026

Jeonbuk Bank won’t own or control the bitcoin itself. The collateral is held by a specialized custodian, limited to virtual asset service providers registered under Korea’s Act on the Reporting of Specific Financial Information, it further noted. 

If a borrower defaults, the bank won’t take the coins but will rather liquidate them through enforcement procedures such as a court-ordered sale and recover the loan from the proceeds.

The bank said it chose bitcoin for its market capitalization and trading volume, the largest of any digital asset, and that its own stress tests showed bitcoin held up as collateral even during sharp price declines. To value the collateral, it uses an index based on a weighted average of prices across multiple global exchanges.

Similar products already exist abroad. JPMorgan Chase debuted bitcoin-backed loans for institutional clients in March, and Switzerland’s Sygnum Bank offers comparable credit.

The loan is the first concrete result of the “Crypto Bank” vision put forward by Jeonbuk Bank President Park Chun-won. The lender is the only regional bank to provide real-name verified accounts to crypto exchanges, and it is preparing an “all-in-one wallet” that combines fiat accounts and digital asset wallets.

“This loan is an example of designing a risk management and recovery structure that allows us to utilize existing bank lending and collateral management systems without directly holding virtual assets,” said Jeong Sang-hoon, executive vice president of the bank’s digital division.

This post South Korean Lender Jeonbuk Bank to Offer Bitcoin-Backed Loans first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Bitget Customers Withdraw Over 4,000 Bitcoins in One Hour Following $388M Hack

Investors withdrew over 4,000 bitcoins worth over $334 million at today’s prices in one hour after hacked Bitget resumed customer withdrawals, the company’s CEO has said. 

Bitget CEO Gracy Chen told Bloomberg Television Tuesday that withdrawals from the exchange had since stabilized following the immediate bitcoin transactions.

Hackers last week made away with $388 million in crypto after targeting the Victoria, Seychelles-based exchange’s hot wallets. 

“The withdrawals actually stabilized a lot today,” Chen said. “Those hundreds of millions [in bitcoin withdrawals] actually most of them happen on the first hour of the withdrawal restart.”

In a Monday X post, Chen said that 9,585 orders of 4,098 bitcoins were processed. The exchange is allowing customers to withdraw funds in phases. 

Bitget froze withdrawals after blockchain experts flagged that money was leaving the exchange. Bitget later said the attack method in the incident was “highly consistent with known patterns of North Korean hacker organizations.” 

Chen said that no cold storage funds were touched but rather attackers had “exploited vulnerabilities from third-party products to steal internal credentials, then used those credentials to send fraudulent withdrawal commands that bypassed our risk controls.” 

She added that the company was using its own money to top up its protection fund after it dropped in size. Bloomberg reported that it was below $200 million after standing at $464 million before the hack. 

Bitget said that it was the first “security incident of this nature in eight years.” 

“The incident remains contained, and no further unauthorized transfers are possible,” the exchange noted. 

Bitget is the sixth biggest by trading volume, according to CoinGecko, processing in the past 24 hours $811 million in transactions. The exchange’s customers are mostly based in Asia. 

Attackers linked to North Korea’s government have long targeted crypto exchanges and are some of the most sophisticated cyber criminals out there. 

This post Bitget Customers Withdraw Over 4,000 Bitcoins in One Hour Following $388M Hack first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

💾