Seoul: The suspected leader of a sprawling international cyber-crime organisation that allegedly targeted Jungkook of BTS and several affluent South Koreans has been extradited from Thailand to face charges in South Korea, authorities confirmed Wednesday. 

The Chinese national, identified only as “A,” arrived at Incheon International Airport on Tuesday after being transferred from Bangkok as part of a coordinated investigation led by the Ministry of Justice of South Korea and the National Police Agency.

Officials allege the suspect orchestrated a hacking operation that stole personal data from hacked websites and attempted to defraud victims of millions of dollars in financial assets.

Extradition and charges

According to KBIZoom, the 40-year-old suspect was handed over to Korean police on Tuesday following a formal extradition request made to Thai authorities last year. Investigators plan to seek a warrant for his formal arrest after questioning him and reviewing the evidence collected.

A previous leader of the same hacking ring, a 36-year-old Chinese national, was extradited in August and remains in detention in South Korea, facing trial.

According to investigators, the cybercrime gang was active between August 2023 and April 2025. During that time, members reportedly infiltrated six government and public institution websites to harvest sensitive personal information.

Using the stolen data, the group allegedly created unauthorised mobile phone and brokerage accounts in victims’ names and circumvented identity verification systems to access financial accounts and cryptocurrency platforms.

Authorities estimate the attempted financial damage at about 38 billion won (roughly $27 million USD).

Jungkook targeted during military service

One of the most notable alleged targets was Jungkook, the globally popular BTS member. The hacking ring is accused of trying to illicitly transfer roughly 8.4 billion won (around $6.1 million USD) in shares of HYBE that were registered under his name while he was serving in the military.

Financial institutions detected the suspicious transactions early and froze the accounts, preventing any confirmed losses.

His agency, BigHit Music, acted promptly after the breach was discovered to secure his assets.

Broader victim list

Investigators also said numerous wealthy South Korean individuals, including senior executives of major companies, were targeted using similar tactics of identity theft and fraudulent account creation.

Authorities are continuing their probe into the organisation’s financial networks and are working to identify additional accomplices linked to the operation.

Ongoing Investigation

South Korean officials emphasized that the extradited suspect will be questioned thoroughly as part of a comprehensive investigation into the ring’s activities.

The Ministry of Justice noted that efforts to detain key figures began last year, with formal extradition requests submitted to Thai authorities in August following initial custody agreements in May.

Police said additional arrests and warrants could follow as evidence continues to be analysed.