A sophisticated cybercrime scheme that used stolen personal data to take control of mobile identities and drain financial accounts is highlighting a growing risk for banks, brokerage firms and cryptocurrency platforms, particularly as U.S. investors and financial companies expand their exposure to increasingly digital Asian markets.
A Chinese national identified by his surname Jeon was sentenced to 20 years in prison on August 20 for his role in a hacking operation that allegedly stole about $27 million from wealthy South Koreans, including corporate executives, entertainers and cryptocurrency investors.
The case illustrates a broader shift in financial crime. Rather than relying solely on conventional phishing attacks, criminals are increasingly combining stolen personal information, unauthorized mobile accounts and access to digital financial services to reach high-value assets. For U.S. financial institutions, the threat underscores the importance of treating mobile identity as part of the financial-security perimeter.
Jeon was convicted of fraud and violations of South Korea’s information-network laws after prosecutors accused him of organizing a hacking group overseas, including in Thailand. The group allegedly collected personal information illegally from August 2023 through January 2025 and used it to open low-cost mobile-phone accounts in victims’ names.
Those accounts were then allegedly used to gain access to bank and cryptocurrency accounts and transfer assets.
The targets included eight corporate chairmen, presidents or chief executives, one corporate executive, three entertainers or influencers and three cryptocurrency investors, according to investigators. BTS member Jungkook was among those targeted, as was the head of a company ranked among South Korea’s 30 largest business groups.
The hackers attempted to steal about $6.1 million worth of shares in HYBE, the entertainment company behind BTS, from Jungkook. His agency detected the attempted theft and took steps to freeze the assets, preventing the attempted transfer from becoming an actual loss.
The Seoul Central District Court said the victims had been deliberately selected because of their wealth and lost control of their assets without contributing to the crimes. The court described the operation as a serious threat not only to individual victims but also to the broader financial system.
The court also said Jeon had not demonstrated genuine remorse. The individual he claimed was the actual mastermind could not be identified or verified, according to the court.
The operation demonstrates how vulnerabilities in telecommunications can spill into financial markets. Once criminals gain control of a victim’s mobile identity, they can potentially intercept authentication codes or use the number as a steppingstone into bank, brokerage and digital-asset accounts.
That creates a particular challenge for financial institutions because conventional cybersecurity defenses are often designed around protecting individual accounts rather than the interconnected chain linking telecommunications providers, banks, brokerages and crypto platforms.
For U.S. companies operating in Asia, the case also points to an investment and compliance issue. Greater reliance on mobile authentication can lower friction for customers and expand digital-finance markets, but it can also increase the cost of fraud prevention, identity verification and regulatory compliance.
South Korean authorities worked with Interpol and Thai authorities to arrest Jeon in Thailand in May 2025. He was extradited to South Korea in August 2025 and indicted the following month.
The case is likely to reinforce pressure on financial and telecommunications companies to strengthen controls over mobile-number transfers, identity verification and unusually large asset movements. For investors, those investments may become an increasingly important cost of doing business as financial services become more tightly integrated with mobile and digital-asset infrastructure.
