Cyber Incident Victim: Youbit
Date:
Dec 2017
Location:
South Korea
Summary
A South Korean cryptocurrency exchange suffered two cyberattacks within eight months, leading to its shutdown and bankruptcy filing after losing 17% of its assets in the second breach. The attackers compromised core systems but failed to access all funds due to partial storage in a secure offline wallet. Customers received approximately 75% of their holdings’ value following the incident. The first attack, attributed to North Korean cyber-spies, resulted in the theft of 4,000 bitcoins, while the perpetrator of the second breach remains unidentified. Separate attacks on other local exchanges were also linked to North Korean operatives, reflecting broader targeting of cryptocurrency platforms amid rising cybercrime exploiting digital currency growth.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Youbit, a South Korean cryptocurrency exchange previously known as Yapizon, suffered two major cyberattacks within eight months in 2017 that ultimately led to its shutdown. The first breach occurred in April 2017, resulting in the theft of 4,000 bitcoins valued at approximately $73 million at the time of reporting. South Korea's Internet and Security Agency (Kisa) attributed this initial attack to cyber operatives working for North Korea, linking it to broader campaigns targeting cryptocurrency exchanges including Bithumb and Coinis. The exchange rebranded to Youbit following this incident but faced another intrusion in December 2017, during which hackers stole 17% of the company's total assets. While the exact financial value of the second theft remained undisclosed, the cumulative impact proved catastrophic. Kisa initiated an investigation into the December breach but did not publicly attribute responsibility for this subsequent attack at the time of reporting.
The December 2017 attack triggered immediate operational collapse, forcing Youbit to file for bankruptcy and cease operations. Customers were notified they would recover approximately 75% of their deposited cryptocurrency value, with the exchange expressing regret over the shutdown. Security measures including the use of a "cold wallet" – an offline storage system for assets not actively traded – prevented greater losses by safeguarding a portion of digital holdings from the attackers. As one of South Korea's smaller exchanges, Youbit's closure contrasted with market-dominant platforms like Bithumb, which controlled 70% of national Bitcoin trading. The incident underscored escalating threats against cryptocurrency platforms, with cybercriminals increasingly targeting exchanges to steal large volumes of digital assets directly rather than through indirect methods like cryptocurrency-mining malware.