The scans began at 3 a.m. that day and combed the firms’ networks for software weaknesses and open ports, authorities said in the notice.
It went out through FIRST, the financial sector’s integrated security monitoring system. It is the first official confirmation of North Korean IP activity since a string of breaches came to light in early October.
Firms were urged to tighten internal controls, watch for anomalies in real time and report any traffic from the flagged addresses. No breach through those addresses has been reported so far.
"Some IP addresses cannot be traced to a specific country, and even when one is identified, the traffic may have been rerouted, so caution is needed in interpreting them," the Financial Supervisory Service said in an Oct. 6 press notice.
While the scans were under way, hackers had already slipped into one of the country's major brokerages.
Daishin Securities said Wednesday that the personal and credit information of 38,490 customers had leaked, more than a week after it first spotted unauthorized access on Oct. 17.
Mirae Asset Global Investments and crypto exchange Bithumb disclosed breaches this week as well.
The attacks have now reached deep into a sector where the Financial Services Commission had already counted 16 breached firms and about 100,000 exposed records as of Oct. 14.
Police opened an investigation Wednesday to determine whether the same attackers were behind the earlier bank breaches.
The presidential National Security Office was set to convene an emergency meeting with financial regulators later in the day to assess the damage.
It would not be the first time North Korea has been blamed for raiding crypto exchanges.
South Korean police said in November 2024 that the North’s Lazarus and Andariel groups stole 342,000 ether, then worth about 58 billion won ($42 million), from local exchange Upbit in 2019.
The FBI blamed Pyongyang for a $1.5 billion heist at Dubai-based Bybit in February 2025.
AJP Takeaways
- Financial authorities in South Korea told financial firms, including crypto exchanges, that IP addresses traced to North Korea made 4,404,101 scanning attempts on the sector starting at 3 a.m. on Oct. 21, 2026.
- On Oct. 28, 2026, Daishin Securities disclosed that personal and credit data of 38,490 customers had leaked. Bithumb, Mirae Asset Global Investments and Mirae Asset Life Insurance also reported intrusions the same week.
- The Financial Services Commission said on Oct. 14, 2026, that 16 financial firms had been breached and about 100,000 personal records leaked. Police opened a probe into the latest cases on Oct. 28.
Copyright ⓒ Aju Press All rights reserved.