International pursuit of a cybercriminal: how South Korea extradited a Lithuanian hacker for embezzling $1.8 million in cryptocurrency

Law enforcement agencies in South Korea have completed a complex five-year investigation and detained a 29-year-old criminal from Lithuania. The suspect employed an innovative approach to theft: distributing a counterfeit activation tool for the Windows operating system called KMSAuto.

Scope of the Criminal Scheme

The malicious program was downloaded over two million times, allowing the criminal to access the financial assets of numerous users. As a result of the attacks, 3100 cryptocurrency wallets were compromised, with funds transferred to the attacker’s addresses. The total amount of stolen cryptocurrency amounted to $1.8 million.

International Cooperation in Action

South Korea’s National Investigation Agency worked closely with Lithuanian colleagues to track the movement of stolen assets on the blockchain. This coordination led to a search of the suspect’s residence in December 2024, where investigators seized 22 electronic devices containing evidence.

Results of Operational Actions

During the investigation, law enforcement managed to block over 840 transactions, thereby preventing further fund diversion. This precedent demonstrates the capabilities of international legal cooperation in combating digital crimes and underscores the need to tighten regulations in the cryptocurrency sector to protect investors and users from such attacks.