Attention is turning to Park Jin-hyok, a North Korean hacker the FBI has kept on its public wanted list for eight years, after a North Korean hacking group was identified as the likely perpetrator behind the theft of about $6.3 billion in virtual assets from Binance, the world's largest cryptocurrency exchange.
According to recent reports by the BBC and other international outlets, the FBI on Oct. 31 attributed the Binance hack to a North Korean hacking group known as TraderTraitor. TraderTraitor is linked to Lazarus, North Korea's most notorious state-sponsored cyberattack organization.
Park's name resurfaced in connection with the Binance hack because he faces charges of involvement in North Korean cyber operations tied to Lazarus.
French virtual asset outlet CoinTribune highlighted Park's alleged past crimes and US wanted history in a report published Nov. 1.
Park has been indicted in the United States on charges of involvement in the 2014 Sony Pictures hack, the theft of funds from the Bangladesh Bank, and the WannaCry ransomware attack.
The US publicly identified Park and obtained an arrest warrant in 2018, but has not been able to take him into custody.
According to a criminal complaint the US Department of Justice unsealed in September 2018, Park studied at Kim Chaek University of Technology in North Korea before working for more than a decade as a programmer at Chosun Expo Joint Venture, a company described as a software developer.
US authorities determined that the firm was a front company supporting the cyber operations of Bureau 110, a unit under North Korea's Reconnaissance General Bureau. Park is also believed to have operated under the company's banner in Dalian, Liaoning Province, China. Investigators concluded that he carried out cyberattacks on behalf of North Korea alongside his software development work.
FBI public records list Park's birth year as both 1981 and 1984, and note that he has used aliases including Pak Kwang Jin.
After his identity was made public, social media users commented on his appearance and hacking skills, with some writing that it was "a waste of such a face and talent."
One of the central charges against Park involves the 2014 Sony Pictures hack. The US film studio was hit by a massive cyberattack ahead of the release of "The Interview," a film depicting the assassination of North Korean leader Kim Jong-un. Hackers broke into the company's network and stole unreleased films, employee emails and personal data, while also destroying internal systems.
The US government blamed North Korea for the attack, concluding that Pyongyang had launched the cyber offensive in retaliation for the film's subject matter. Park was named in the Justice Department's criminal complaint in connection with the incident.
Park also faces allegations of involvement in the 2016 Bangladesh Bank hack. In that case, hackers infiltrated the bank's internal network and used the SWIFT interbank messaging system to send fraudulent wire transfer instructions to the Federal Reserve Bank of New York. The attackers initially sought to steal about $1 billion, but some transactions were blocked, and the actual amount taken reached $81 million.
The following year, Park was also accused of participating in the WannaCry ransomware attack, which targeted hospitals, businesses and public institutions around the world. WannaCry is malware that encrypts files on infected computers and demands payment for their recovery. Institutions and companies across multiple countries were affected, including facilities under the United Kingdom's National Health Service.
An attempted cyberattack on US defense contractor Lockheed Martin also fell under investigation. North Korean hackers including Park allegedly sent malicious emails to Lockheed Martin between 2016 and 2017 in an attempt to breach its systems. Some of the emails contained references to the Terminal High Altitude Area Defense system, known as THAAD, deployed by USFK. The Justice Department said the attack did not succeed.
Regarding these activities, the Justice Department in February 2021 unsealed an expanded indictment against Park and two other North Korean hackers, Jeon Chang-hyok and Kim Il. The indictment charged the three with attempting to steal or extort more than $1.3 billion in cash and virtual assets from financial institutions and companies worldwide, as well as creating and distributing malicious cryptocurrency applications.
The US obtained a new arrest warrant for Park in December 2020 on additional charges including bank fraud conspiracy, but investigators have still not taken him into custody. Australia also placed him under financial sanctions and banned him from entering the country in November last year.
Park currently remains on the FBI's public wanted list. The bureau's wanted materials list his last known location as North Korea.
North Korea, however, denied Park's very existence when the US indictment was announced in 2018, claiming he was a fictitious person.
Despite the US releasing his identity, aliases and record of activity in China — and continuing to pursue him internationally — his whereabouts remain unknown eight years after the wanted notice was issued.
min3654@heraldcorp.com
