DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

Youbit

Date (as written)
2017-12
Year
2017
Country
Korea, Republic of
Actors (as written)
Bluenoroff
Actor pages
Bluenoroff
Tags (as written)
FinancialGain Cryptocurrency
Dollar figures (as written)
$7,450,000; 2.65m; approximately 17% of its total assets; 17% of assets; -

Source entries (8)

lazarus.day

Youbit · 2017-12
Youbit was listed among South Korean cryptocurrency-exchange hacking incidents in reporting that described rising unauthorized withdrawals, unresolved police investigations, and the difficulty of tracing blockchain-enabled thefts through international cooperation. The linked evidence provides policy-level DPRK risk context and broader UN reporting on DPRK cyber theft from financial institutions and cryptocurrency exchanges, but does not give a specific intrusion chain, malware family, infrastructure, or exchange-level indicators for Youbit.
https://lazarus.day/incidents/youbit/

EuRepoC

Youbit Hack by Lazarus · 01.05.2017
The South Korean crypto exchange Youbit fell victim to a large-scale security breach that led to the theft of a fifth of its user funds. The North Korean Lazarus Group is suspected to be behind the attack.
https://bitnewsbot.com/north-korea-accused-of-hacking-south-korean-bitcoin-exchange-youbit/
https://www.fireeye.com/blog/threat-research/2017/09/north-korea-interested-in-bitcoin.htmlhttps://www.recordedfuture.com/north-korea-cryptocurrency-campaign/

tayvano/lazarus-bluenoroff-research

Youbit aka Yapizon aka Coinbin · 2017-01-01
Amt Stolen: $7,450,000
https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/youbit_aka_yapizon_aka_coinbin.md

UN Panel of Experts S/2019/691

Theft of 17 percent of Youbit assets in second attack on Youbit. Youbit later declared bankruptcy as a result · 19 Dec 2017
Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. B. Cryptocurrency. Theft of 17 percent of Youbit assets in second attack on Youbit. Youbit later declared bankruptcy as a result of hack.
https://undocs.org/S/2019/691

UN Panel of Experts S/2024/215

Youbit/Yapizon/ Coinbin · 19 December 2017
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2017: Victim: Youbit/Yapizon/ Coinbin; Date: 19 December; Amount (USD equivalent): 2.65m; Location: ROK
https://undocs.org/S/2024/215

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Youbit · 2017-12
Reported: 2017-12; Victims: Youbit; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: Korea, Republic of
https://data.mendeley.com/datasets/wwb2rzgfn7/2

US court filing via CourtListener RECAP: United States v. 113 VIRTUAL CURRENCY ACCOUNTS

Hack of The Exchange 2, a South Korea-based virtual currency exchange · On or about December 19, 2017
On or about December 19, 2017, The Exchange 2 announced through its website and various media outlets that it had been a victim of a hack and subsequent theft of approximately 17% of its total assets. The Panel of Experts subsequently attributed this hack to North Korean actors. [Case No. 1:20-cv-00606, U.S. District Court for the District of Columbia; filing: COMPLAINT against 113 VIRTUAL CURRENCY ACCOUNTS]
https://storage.courtlistener.com/recap/gov.uscourts.dcd.215786/gov.uscourts.dcd.215786.1.0_1.pdf

UN Panel of Experts S/2019/171

YouBit · Dec 2017
Annex 39: Open source report on attacks on Crypto Exchanges, January 2017-September 2018 (image of Group-IB table “Successful attacks on crypto exchanges 2017-2018”, source www.group-ib.com/media/gib-crypto-summary/). Row: Date: Dec 2017; Name of Project: YouBit; Country: South Korea; Criminal group: Lazarus; Stolen in cryptocurrency: 17% of assets; Stolen in USD: -. (Rows in the same table with Criminal group “Unknown” are not taken.)
https://undocs.org/S/2019/171

Suggest a correction on GitHub