$25.5 mil. cybercrime ringleader targeting BTS' Jung Kook extradited from Thailand

Justice Ministry officials escort a Chinese national, suspected of being a ringleader of group that stole large sums by impersonating wealthy individuals, through Incheon International Airport, Aug. 22, 2025. Newsis

The suspected ringleader of a cybercrime network accused of stealing the personal data of wealthy individuals — including BTS member Jungkook — to withdraw funds from their financial accounts has been extradited to Korea and placed in custody by authorities.

According to the Ministry of Justice and the National Police Agency (NPA), the 40-year-old Chinese national arrived at Incheon International Airport from Bangkok, Wednesday. He is the second key suspect in the case, following a 36-year-old Chinese accomplice who was extradited to Korea, indicted and detained in August last year.

The group is suspected of running a cybercrime network based in several countries but primarily operating out of Thailand. From August 2023 to April 2024, it allegedly siphoned off more than 38 billion won ($25.5 million) by using illegally obtained personal data to gain access to victims’ bank and cryptocurrency accounts.

Investigators said the group hacked multiple websites to obtain personal data, then used the stolen identities to open low-cost mobile lines and pass identity verification, allowing them to gain unauthorized access to financial accounts.

Victims identified so far include celebrities, conglomerate chairs and startup founders.

In one high-profile case, a securities account belonging to Jungkook was targeted, with an attempt to transfer HYBE shares worth about 8.4 billion won. The transaction was blocked after the company swiftly froze the account, preventing any losses.

The ministry said it requested the suspect’s provisional arrest from Thai authorities in May last year, followed by a formal extradition request in August. Provisional arrest is a treaty-based measure used to secure custody of a suspect pending extradition proceedings.

The ministry, in coordination with the NPA and Interpol, carried out a joint operation in Thailand in May last year that led to the arrest of a key accomplice — the 36-year-old Chinese national — along with 16 other members of the group. Authorities also secured custody of the latest suspect at the same location.

The first suspect was brought to Korea on Aug. 22 last year and was subsequently indicted and detained on Sept. 16. He is currently standing trial.

The ministry said the government will continue to work closely with relevant agencies, including the NPA and the Ministry of Foreign Affairs, to track down the perpetrators of transnational crimes such as hacking and online fraud.