The 40-year-old suspect is alleged to have headed a hacking organization operating from overseas bases, including Thailand, that targeted websites of low-cost mobile carriers and other companies between August 2023 and April 2025, according to a statement from South Korea’s Justice Ministry.

The suspect was arrested in Bangkok during an Interpol-coordinated operation and transferred to South Korea through cooperation between Thai authorities and Seoul’s National Police Agency. He arrived at Incheon International Airport on Wednesday, officials said.

Investigators allege the group used illegally acquired personal data to infiltrate financial and cryptocurrency accounts before making unauthorized withdrawals from victims.

South Korean media reports said the alleged victims included celebrities, senior business executives and startup founders. Jungkook, a member of global K-pop group BTS, was among those reportedly targeted.

According to the Kyunghyang Shinmun newspaper, Jungkook’s securities account identity was allegedly compromised and shares in HYBE valued at 8.4 billion won ($5.6 million) were transferred without authorization.

The report said the singer avoided financial losses after payment suspension measures were implemented immediately.

South Korean authorities said an alleged accomplice, a 36-year-old Chinese national arrested in Thailand in May 2025, had already been extradited to South Korea in August last year and was indicted the following month. Court proceedings against him remain ongoing.

South Korean prosecutors and investigators traveled to Thailand in July 2025 for meetings with Thai police and prosecutors as part of the cross-border investigation, according to officials.

The case highlights growing regional cooperation among Asian law enforcement agencies against cybercrime networks that increasingly operate across jurisdictions and target digital financial systems, cryptocurrency holdings and personal data infrastructures.