A Chinese national accused of masterminding a massive hacking scheme that siphoned off 38 billion KRW (approximately $28 million) from the financial and virtual asset accounts of prominent South Koreans, including BTS member Jungkook, has been arrested in Thailand and extradited to Seoul.

According to South Korea’s Ministry of Justice, the suspect, identified only as ‘A’ (34), was extradited from Bangkok to Incheon International Airport at 5:05 a.m. on August 22. Authorities said A organized an international hacking ring that infiltrated numerous websites, including major telecom operators, between August 2023 and January 2024. The group illegally harvested personal information, used it to open mobile phone accounts under stolen identities, and transferred funds from financial and cryptocurrency accounts.

Among the victims were corporate chairmen, venture company CEOs, and high-profile celebrities. Jungkook, a member of the global supergroup BTS, was one of those targeted. Shortly after his military enlistment in January last year, hackers stole 33,500 shares of HYBE stock worth about 8.4 billion KRW (approximately $6.2 million) from his securities account.

The hackers sold 500 of those shares, valued at about 126 million KRW (around $92,000), to a third party.

However, HYBE’s label Big Hit Music quickly froze the account, preventing further losses. Jungkook’s legal team filed a lawsuit for the return of the shares, and the Seoul Western District Court later ruled in his favor, declaring that no legitimate transfer had taken place and ordering the buyer to return the shares.

Investigators with the Seoul Metropolitan Police, working with Interpol, tracked A’s movements and learned in April that he had entered Thailand. South Korean authorities then requested his provisional arrest for extradition, a legal mechanism that allows for the urgent detention of a suspect prior to a formal extradition request. Thai officials detained A within two weeks, leading to his handover to Seoul.

The Seoul police plan to question A, analyze seized materials, and seek a formal detention warrant. A Justice Ministry official said that the government would continue to pursue and strictly punish overseas-based hacking, voice phishing, and online fraud organizations until the end.