South Korean police are pursuing cooperation with the U.S. Federal Bureau of Investigation to identify who was behind a series of hacking attacks on domestic financial firms. A man in his 20s living in China was initially named as the attacker, but police are investigating on the assumption that the actual attacker could be someone else.
The National Police Agency and other related domestic agencies recently sent an official letter to the FBI and have moved ahead with international cooperation procedures, according to police and other sources on the 13th. The progress of the push for joint investigation with the U.S. has also been reported to higher authorities.
The cooperation is aimed at securing data needed to confirm the attacker's identity, including account information and access logs held by a global security firm and an artificial intelligence company based in the U.S.
Earlier, U.S. cybersecurity firm CrowdStrike raised the possibility that a 26-year-old man living in China's Guangdong Province was involved in the hacking, based on resume details the attacker had entered into the AI coding tool Claude Code. The initials of the name the attacker typed in, a Telegram account and a place of residence were used as clues. But the man claims he has nothing to do with the case, saying his mobile phone number was stolen, leaving the attacker's identity unconfirmed.
Police are therefore not treating any specific individual as the culprit and are investigating with all possibilities in mind. They are in particular reviewing the U.S. security firm's grounds for its identification, as well as material suggesting possible links to Chinese groups that carry out distributed denial-of-service, or DDoS, attacks for hire.
The hacking case came to light as breaches were confirmed one after another at seven financial companies, including Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. The attacker is believed to have switched internet protocol addresses while running automated attacks using AI tools.
Asked whether police were specifically working with the FBI, a police official said, "Given the need to maintain trust with the partner country, we cannot confirm the progress."