In a high-profile cross-border cybercrime case that has drawn international attention, a 40-year-old Chinese national accused of masterminding a multi-million dollar hacking operation that counted BTS member Jungkook among its high-profile victims has been handed over to South Korean authorities following extradition from Thailand.
South Korea’s Ministry of Justice has laid out detailed charges against the unnamed suspect, accusing him and his criminal network of stealing a total of 38 billion won, equal to approximately $25.4 million or £18.8 million, from a wide range of targets. The group’s illegal activities included breaking into digital accounts tied to both government agency websites and the personal profiles of prominent public figures, according to official allegations.
One of the most high-profile attempted heists targeted the BTS vocalist: the hacking ring gained unauthorized access to a securities account registered under Jungkook’s name, and attempted to siphon off 8.4 billion won worth of shares the K-pop star holds in Hybe, BTS’s parent entertainment and management company. Local South Korean media outlets confirmed that the suspicious transfer was halted before it could be completed, after Hybe’s internal security team moved quickly to freeze the compromised account.
Court and law enforcement records show the string of cyberattacks linked to the group took place over a 20-month period, running from August 2023 through April 2025. Beyond the Jungkook case, the criminal network also targeted other high-profile individuals across South Korea, including the chair of a large domestic conglomerate and the chief executive of a local venture capital firm, reporting from Agence France-Presse confirmed.
Prior to his extradition, the suspect had been residing in Bangkok, Thailand. This is not the first extradition connected to the same hacking ring: back in August 2024, a 36-year-old Chinese national also linked to the group was extradited to South Korea from Thailand. That defendant was formally indicted in September 2024 and is currently on trial facing cybercrime and theft charges in a South Korean court.
South Korean law enforcement officials confirmed that following the suspect’s arrival in the country, investigators will first conduct a formal interrogation and process evidence collected from across the investigation. After completing this initial phase, police announced they intend to submit an application for an arrest warrant to formally detain the suspect ahead of upcoming judicial proceedings.