How the Upbit Hackers Split 342,000 Stolen ETH

On 27 November 2019, 342,000 ETH left a hot wallet of Upbit, a large Korean crypto exchange, in a single transaction. Dunamu, the company that runs Upbit, disclosed the loss the same day and said it would cover it. Five years later, South Korean police named North Korea's Lazarus and Andariel groups as the thieves, Korea JoongAng Daily reported.

We traced the stolen coins again with the Bitquery MCP server. Each step below shows the question we gave the AI and the tool it called to answer. We ran every query on 15 October 2026. All times are UTC.

Role	Address
Upbit hot wallet	0x5e032243d507c743b061ef021e2ec7fcc6d3ab89
Hackers' first wallet	0xa09871aeadf4994ca12f5c0b6056bbd1d343c029

Step 1: the theft

We asked: "Who sent ETH to the hackers' first wallet, and how much?"

The AI used eth_address_flow_summary, then labels_for_addresses on the sender.

What the ledger shows	Figure
Sent from	Upbit hot wallet (Bitquery label)
Amount	342,000 ETH
Time	27 Nov 2019, 04:06 UTC (13:06 in Seoul)
Value then	about $49.7 million
Transaction	0xca4e0aa2…26b4

The hackers' wallet sat untouched for about 27 hours. Then it moved everything.

Step 2: one wallet becomes three, then six

We asked: "Where did the hackers' wallet send the ETH? Follow each branch one more step."

The AI used eth_flow_edges on the first wallet, then on each wallet it paid.

On 28 November, between 07:08 and 08:53, the first wallet split the haul three ways. By 15:08 the same day, each of those had split again in two.

First split	ETH
0xc7d6…229a	120,280
0x3408…973b	111,010
0x9a20…920d	111,010

Second split	ETH	Paid by
0xeed2…887f	61,004	0xc7d6…229a
0xb3a9…a0a5	59,176	0xc7d6…229a
0xf52b…c8f5	61,010	0x3408…973b
0x4d53…cace	49,900	0x3408…973b
0xf467…fe3f	60,100	0x9a20…920d
0x9409…48c5	50,810	0x9a20…920d

Each of the three wallets in the first split also sent exactly 100 ETH back to the first wallet. Bitquery labels all nine wallets in these tables, and 747 Ethereum addresses in total, as part of the Upbit hack.

Step 3: 18 pieces of 11,001 ETH

We asked: "When did the six wallets send their ETH on, and in what sizes?"

The AI used eth_transfers_raw_sql to group the six wallets' payments by day.

The six wallets broke the money into pieces of almost the same size. Eighteen were exactly 11,001 ETH, each paid in two parts to a new address. Most other large pieces were between 10,000 and 16,001 ETH, and the last remainders went out in smaller amounts.

Period	ETH sent by the six wallets
28 Nov 2019	33,000
2 to 6 Dec 2019	219,120
13 to 23 Dec 2019	22,032
5 to 13 Jan 2020	55,504
6 to 13 May 2020	15,043
March 2021	22

About three quarters of the haul, 252,120 ETH, had moved on by 6 December, nine days after the theft. The totals above add up to a little more than 342,000 because some ETH came back into the six wallets and went out again.

Step 4: past the first steps

We asked: "Follow the largest payments from these pieces five more steps. Stop at an exchange."

The AI used eth_trace_dominant_path, which follows the largest payment out of each address, then checked every address against Bitquery's address labels.

On the paths we followed, no exchange appeared within five steps. Each path passed through more fresh addresses, some of them already labelled as Upbit-hack wallets. Several pieces also merged again. One address received 15,000 ETH from one of the six wallets and 10,000 ETH from another in January 2020.

This is where an on-chain trace on its own runs out of road. The police account fills in the rest.

What the police found

On 21 November 2024, South Korea's National Office of Investigation said North Korea's Lazarus and Andariel groups carried out the hack. It was the first time a South Korean investigative agency had confirmed North Korea's role in a crypto theft. Investigators used IP addresses, transaction records, North Korean wording and evidence shared by the FBI, according to the Korea Times.

Police said 57% of the stolen ETH was sold for Bitcoin at 2.5% below the market price, on three exchange websites they believe North Korea set up. The rest was spread across 51 overseas exchanges. The month before, police had returned 4.8 BTC of the stolen funds to Upbit, the Korea Times reported.

What changed from the 2020 version

Our first write-up, in July 2020, used a Coinpath query that added up every path from the hackers' wallet over 10 and 12 steps. It reported that Binance received more than 100,000 ETH and Bity 3,661 ETH. A total built that way can include money from other people that passed through the same addresses, so it does not measure stolen ETH alone. We have not repeated those figures here. This version reports only what we measured step by step.

Run this trace yourself

Connect the Bitquery MCP server to your AI client with one URL: https://mcp.bitquery.io. Tracing sits on the AI Investigation MCP plan, at $149 per month on our pricing page. The setup guide covers each client.

Client	How to connect
Claude Desktop / Claude web	Settings, Connectors, add custom connector https://mcp.bitquery.io
ChatGPT	Settings, Connectors, add a connector with the same URL
Cursor	Settings, MCP, Add new MCP server
Claude Code	claude mcp add --transport http bitquery https://mcp.bitquery.io

Then try these prompts:

Where did 0xa09871aeadf4994ca12f5c0b6056bbd1d343c029 send its ETH?
Follow two steps and label each address.

Which addresses carry the label hacker-upbit-2019?

Follow the largest payment out of
0xeed2bb3aa8edbb357756432da0223b8f3226887f for five steps
and stop at an exchange.

No AI client? MoneyFlow Lite follows funds from an address in your browser, on 17 chains including Ethereum. It draws on your Bitquery API quota; try it on the 7-day trial.

For two more traces, see where the Twitter hack Bitcoin went and who won and lost in FairWin.

Frequently asked questions

How much was stolen in the Upbit hack?

342,000 ETH, taken from an Upbit hot wallet on 27 November 2019. It was worth about $49.7 million at the time.

Who hacked Upbit?

South Korean police said in November 2024 that North Korea's Lazarus and Andariel groups did it, using evidence that included IP addresses and records shared by the FBI.

Where did the stolen Upbit ETH go?

It was split into three wallets, then six, then pieces of 10,000 to 16,001 ETH, most of it within nine days. Police said 57% was later sold for Bitcoin on three exchange websites, and the rest was spread across 51 overseas exchanges.

Can you still trace the Upbit hack wallets?

Yes. Bitquery labels 747 Ethereum addresses as part of the Upbit hack, and the MCP server can follow any of them.

Related reading

• Where did the Twitter hack Bitcoin go? A full trace
• FairWin: who won and who lost in the Ethereum Ponzi
• Cryptocurrency money laundering explained

First published in July 2020. Rewritten on 15 October 2026: every figure was worked out again with the Bitquery MCP server, the 2020 multi-path exchange totals were removed, and AI tools helped run the queries and draft the text. Bitquery sells the MCP server named above. This post describes what the public ledger records. It names attackers only where police have named them.