Authorities say North Korea was behind the 2019 theft of 58 billion won, or around 42 million U.S. dollars, in cryptocurrency from a South Korean virtual asset exchange.

The National Office of Investigation said Thursday that two North Korean hacking groups affiliated with the regime’s Reconnaissance General Bureau, Lazarus and Andariel, were involved in the operation.

In November 2019, 342-thousand ethereums were stolen from the South Korean virtual asset exchange Upbit.

The conclusion was based on an analysis of a North Korean IP address, the flow of cryptocurrency, the use of Korean-language terms used in the North, and documents obtained in coordination with the FBI in the United States. 

Fifty-seven percent of the stolen ethereums were converted to bitcoins at two-point-five percent lower than the market price, while the rest were transferred to 51 overseas exchanges for laundering.

The police verified in October 2020 that some of the stolen assets that were converted to bitcoins were being stored at a virtual exchange in Switzerland.

Last month, four-point-eight bitcoins worth around 600 million won were retrieved from the Swiss exchange and returned to Upbit.