Korean teens make bomb threats: 'Virtual countries' on Discord are behind them

Police and military personnel search Kakao’s Pangyo Agit building in the Bundang district of Seongnam, Gyeonggi Province, following a bomb threat on Dec. 15, 2025. Yonhap

It was 6:05 p.m. on a winter evening when a bomb threat quietly appeared on a customer service board run by one of South Korea’s largest telecommunications companies.

“The bomb will detonate at KT headquarters at 9 p.m.,” the message read. Written in a dry, almost matter-of-fact tone, the threat carried a chilling menace.

“Unless 10 billion won (about $7.5 million) is transferred to a designated online bank account, a knife attack will follow.”

Police rushed to respond. The KT headquarters building was searched floor by floor for explosives. Patrol cars swept surrounding streets while two riot police units sealed off the area, pushing the neighborhood into confusion.

Somewhere else, someone watched the unfolding fear with quiet satisfaction.

Inside a private online community, the suspect — identified by police as X — boasted about officers scrambling at the scene. With evident satisfaction, he wrote, “I’ve gone through multiple countries using VPNs, so tracing my IP address is impossible.”

Followers responded instantly. Some praised his ability to evade detection, while others mocked law enforcement. Admiration quickly gathered for the figure they portrayed as someone who had outmaneuvered both a major technology company and government authorities.

Firefighters respond to a reported bomb threat at a high school in Asan, South Chungcheong Province, Oct. 13, 2025. Courtesy of Asan Fire Station

A 'virtual nation' run by teens

“Citizens are advised to prepare for war with proper discipline.”

Late at night, tension spread across a Discord server operated as a self-described “virtual nation.” On a bulletin board dedicated to terror announcements, a declaration of war against a rival server appeared. The message warned that any member declaring neutrality would be sent to a detention camp under wartime regulations. Rows of salute emojis quickly followed beneath the post.

Minutes later, the targeted server was crippled by a distributed denial of service (DDoS) attack. Soon after, posts appeared announcing that the “operation” had been completed. Within the digital world, the conflict was recorded as a victory.

In South Korea, Discord — originally developed in the United States as a voice-chat platform for gamers — has evolved into a closed online environment among teenagers. Access to many servers requires invitation links, creating insulated communities where elaborate role-playing structures have taken root.

Some of those spaces now simulate functioning states. Participants construct governments, military chains of command and diplomatic channels, treating interactions with rival servers as geopolitical competition. In certain cases, those competitions have escalated into coordinated cyberattacks and harassment campaigns conducted under the language of warfare.

Police investigations show that the size of these virtual nation communities varies considerably. Servers with more than 500 members are typically regarded as large, and alliances between servers can push membership beyond 2,000 users.

The server linked to the suspect, X, was among the larger communities. Alongside these major servers, dozens of smaller virtual nation communities have appeared across Discord.

Within these servers, participants operate under structured hierarchies. Members assume roles such as citizens, soldiers and diplomats, advancing through ranks by completing assigned tasks. Diplomats may rise to minister-level positions, while soldiers can be promoted to top command roles.

The fastest way to gain promotion is by carrying out attacks against rival communities, according to police. Recurring announcements within some servers promise users additional points for conducting attacks on other virtual nations.

Lower-ranked participants often upload screenshots of successful attacks to accumulate points, which in turn translate into status, influence and recognition within the community.

Through this hierarchy, X rose to the rank of general, gaining influence, virtual assets and a growing circle of followers. Investigators believe that the pursuit of status helped drive his decision to issue the bomb threat at KT headquarters, as he sought greater recognition within the online community.

Digging up personal data for impersonation

Despite being deeply immersed in online communities, X took steps to conceal his real name. He used a different person’s identity when posting his threat. The name also happened to be someone with whom he previously clashed in the server.

According to investigators, conflicts in these communities often lead to digging up personal information about rivals. In the case of X, he used five different names while posting threats, including one linked to Seoul Station.

All the names belonged to individuals with whom X had previously been in conflict. They were also the first to be tracked down by police. Police say X later mocked law enforcement responses in online chats.

Police are already familiar with the pattern, investigators said, classifying the incidents as “swatting” — a crime that originated in the United States in which false public threats are used to dispatch heavily armed police units to a victim’s home or workplace, often as a form of intimidation or harassment.

“In this case, it is particularly troubling that threats were directed at public places unrelated to virtual nation disputes, including schools, companies, broadcasting stations and train stations, heightening public anxiety,” a police official said.

Police and military personnel search Kakao’s Pangyo Agit building in Bundang district of Seongnam, Gyeonggi Province, following a bomb threat on Dec. 15, 2025. Yonhap

Teen swatting networks expand across virtual nation servers

Investigators say that beginning last October, they traced a series of terror threats involving underage teens to higher-ranking participants of Discord virtual nation servers. X is known to have been acquainted with Y, 18, and Z, 18, both suspected of repeatedly posting terror threats online.

Y posted at least 10 bomb threats targeting Kakao Corp.’s Pangyo headquarters and KT’s Bundang headquarters in Seongnam, Gyeonggi Province, along with posts threatening to assassinate the president. Z issued 13 school bomb threats in October alone and made false emergency calls to 119, police said.

Investigators believe the pattern reflects attempts to gain status within the online communities while impersonating lower-ranked participants, causing them to become targets of swatting attacks. The cases illustrate how recognition-seeking and competitive behavior within teenage online communities can escalate into real-world crime.

“The attitude of treating the harassment of weaker participants and the display of ability within online communities as acceptable behavior contributed to these terror threat crimes,” said Cho Kyung-mook, head of the violent crimes unit at Bundang Police Station, who investigated X and Y.

Bundang Police transferred X to prosecutors on public intimidation charges and requested an arrest warrant for Y on similar charges. Z was arrested by the Incheon Metropolitan Police Agency’s criminal investigation unit; he was indicted and appeared in court on Feb. 6.

This article from the Hankook Ilbo, the sister publication of The Korea Times, is translated by a generative AI system and edited by The Korea Times.