Seoul: A Chinese national identified as the ringleader of a hacking group that targeted BTS member Jungkook and several wealthy South Korean individuals has been sentenced to 20 years in prison by a Seoul court. The group allegedly stole or attempted to steal assets worth about 38 billion won (around Rs 2,500 crore), including HYBE shares belonging to Jungkook.
The case involved the illegal collection of victims’ personal information, unauthorised mobile phone accounts and access to financial and cryptocurrency accounts. Jungkook’s HYBE shares worth approximately 8.4 billion won (around Rs 55 crore) were among the assets targeted. However, the attempted theft did not ultimately result in a financial loss for the singer.
Court sentences hacking ring ringleader
The Seoul Central District Court sentenced the Chinese national, identified by his surname Jeon, to 20 years in prison on charges including fraud under South Korea’s Act on the Aggravated Punishment of Specific Economic Crimes and violations of the Information and Communications Network Act.
The court criticised the nature of the crimes, noting that the victims were targeted because of their wealth and lost assets without having done anything to expose themselves to the risk.
The court also said the crime had the potential to undermine the country’s financial system.
The defendant was found to have played a leading role in an organised criminal operation that targeted wealthy individuals, celebrities and cryptocurrency investors.
Jungkook’s HYBE shares were among the targets
Jungkook became one of the most high-profile targets of the hacking operation.
According to investigators, the group obtained personal information and used it to create an unauthorised brokerage account in the BTS star’s name. The account was reportedly opened in January 2024, shortly after Jungkook began his mandatory military service.
The hackers attempted to transfer approximately 33,000 HYBE shares belonging to Jungkook. At the time, the shares were valued at around 8.4 billion won.
The incident demonstrated how criminals could exploit stolen personal information to gain access to financial assets belonging to high-profile individuals.
HYBE prevented Jungkook from suffering financial losses
Although the hackers attempted to move Jungkook’s shares, the singer did not ultimately lose the value of the targeted assets.
His agency, BigHit Music, acted after the suspicious activity was detected and took measures including suspending payments connected to the account and restoring the affected assets.
The company also strengthened security measures surrounding artists’ personal and device information following the incident.
A separate legal dispute also arose over 500 HYBE shares that had been transferred to a third party. A court later ordered the third party to return the shares to Jungkook.
How the hacking operation worked
Investigators found that the criminal group allegedly collected personal information belonging to wealthy individuals between August 2023 and January 2025.
The information was then allegedly used to obtain mobile phone connections in victims’ names.
Once the criminals gained control of these accounts and obtained access to financial information, they could attempt to transfer money, securities and cryptocurrency.
The group allegedly stole more than 38 billion won through this method.
The targets reportedly included business executives, celebrities, influencers and cryptocurrency investors.
Several high-profile people were targeted
Jungkook was not the only prominent person targeted by the criminal group.
Investigators said the victims included eight business chairmen, representatives or senior executives, an additional company executive, three celebrities or influencers and three cryptocurrency investors.
The selection of victims appeared to be based largely on their financial status and the value of assets they were believed to possess.
This made the case considerably broader than an attempted theft involving a single celebrity.
Jungkook’s military service was linked to the timing
The attempted theft of Jungkook’s HYBE shares occurred after he began his mandatory military service.
Reports in 2025 revealed that an unauthorised account had been created in his name and that shares had been transferred to it.
At the time, the value of the targeted shares was estimated at 8.4 billion won, equivalent to around $5.7 million based on contemporary exchange rates.
The incident raised concerns about how criminals could exploit periods when celebrities are less directly involved in managing their financial accounts.
The actual loss was prevented
One of the most important aspects of the case is that the attempted theft of Jungkook’s shares did not translate into a permanent financial loss.
BigHit Music intervened after becoming aware of the suspicious transactions.
The agency took steps to stop the transactions and restore the affected assets, preventing substantial damage to Jungkook.
The case nevertheless resulted in a significant security concern because the hackers had managed to create an account and access valuable assets using the singer’s identity.
International investigation led to arrest
The investigation involved international cooperation because the hacking operation was linked to activities outside South Korea.
Police worked with Interpol and arrested Jeon in Thailand in May 2025.
He was subsequently extradited to South Korea in August 2025 through cooperation between the country’s Justice Ministry and police authorities.
He was formally indicted in September 2025 and remained in custody during the proceedings.
The international nature of the investigation highlighted the difficulty of pursuing organised cybercrime groups operating across multiple countries.
Why the sentence is significant
The 20-year prison sentence reflects the seriousness with which South Korean authorities have treated the case.
The court said the victims had been targeted without any fault of their own and that the crimes went beyond ordinary financial scams.
The court also considered the defendant’s apparent lack of genuine remorse while determining the sentence.
The verdict sends a strong message about the consequences of organised identity theft and cyber-enabled financial fraud.
A wider warning for celebrities and investors
The case also highlights the risks faced by individuals holding substantial assets online.
Celebrities and high-net-worth individuals often have large portfolios of stocks, cryptocurrency and other investments that can become targets for sophisticated criminal networks.
The Jungkook case demonstrates that criminals may not necessarily need to steal passwords directly. Access to personal information can potentially be enough to impersonate a victim and create new accounts or obtain control over financial services.
Conclusion
A South Korean court has sentenced the Chinese ringleader of a hacking group that targeted BTS member Jungkook and other wealthy individuals to 20 years in prison. The group allegedly stole or attempted to steal around 38 billion won, with Jungkook’s HYBE shares worth approximately 8.4 billion won among the assets targeted.
In Jungkook’s case, the attempted theft was detected and stopped before it caused substantial financial damage. His agency acted quickly to suspend the suspicious transactions and restore the affected assets.
The case highlights the growing threat posed by identity theft and organised cybercrime, particularly when criminals target valuable financial assets belonging to celebrities, business leaders and other wealthy individuals.