BTS member Jungkook was one of several high-profile victims targeted in a sophisticated hacking scheme that attempted to steal approximately 8.4 billion won (around $6m) worth of HYBE stock.
The ringleader of the operation, a 34-year-old Chinese national, was forcibly repatriated from Bangkok, Thailand, to Incheon Airport on August 22, 2025, according to the Ministry of Justice.
He led an international hacking organization that operated across multiple countries, including Thailand. Between August 2023 and January 2024, the group illegally accessed personal data by infiltrating mobile carrier websites.
Using this information, they opened unauthorized accounts in the names of victims and transferred funds and virtual assets from their bank and investment accounts without consent.
The scheme targeted many wealthy individuals in South Korea, including celebrities, prominent business executives, and heads of venture companies.
Jungkook, who had enlisted in the military shortly before the theft, became one of the most notable victims. His securities account was compromised in January 2024 that resulting in the unauthorized transfer of 33,500 shares of HYBE stock, valued at 8.4 billion won. However, BIGHIT MUSIC swiftly froze the account to prevent further financial loss.
In March last year, a third party acquired 500 of the stolen shares. Jungkook and BIGHIT promptly filed a civil lawsuit to reclaim them. The court ruled in his favor, stating that no valid transfer agreement existed and affirming that the BTS maknae was a victim of identity theft. All disputed shares were subsequently returned.
The Ministry of Justice emphasized that the hacker’s arrest is part of a broader effort to combat international cybercrime. In relation to this, the official revealed
The identified victims include several high-profile celebrities, CEOs of major corporations, and founders of venture companies, among other prominent figures in Korea.
Besides targeting Jungkook, the criminal network hacked multiple websites and stole a total of 38 billion won ($27.3m) from various financial and virtual asset accounts. The group’s operations involved meticulous planning, including exploiting telecom systems to gain sensitive personal data.
Currently, Jungkook has resumed activities after completing military service. He is in LA with bandmates working on new group music, releasing next year.
Meanwhile, BIGHIT MUSIC continues to monitor his accounts and enforce security measures to protect its artists from potential cyber threats. Despite the attempted theft, the court ruling ensures Jungkook’s financial assets are secure, and the arrest of the ringleader brings a sense of closure to the case.
