How Hackers Tried to Steal Jungkook’s HYBE Shares

BTS member Jungkook became one of the high-profile targets of a sophisticated hacking operation that went far beyond a simple online scam. Hackers allegedly used stolen personal information to access financial accounts belonging to wealthy South Koreans, including celebrities and major business figures. Among the targets were Jungkook’s HYBE shares worth about 8.4 billion won, or roughly $6 million at the time. The most surprising part of the story is that the attempted theft was stopped before it became an actual financial loss for Jungkook. Now, a Seoul court has sentenced the alleged ringleader to 20 years in prison.




Jungkook was not the only target. Investigators found that the group focused on wealthy individuals, including corporate executives, celebrities, influencers and other high-profile figures. Reports said the organisation targeted people who might not immediately notice suspicious activity, including individuals serving in the military or otherwise unable to respond quickly. Jungkook was targeted while serving in the military. Around 33,000 HYBE shares worth approximately 8.4 billion won were reportedly moved into an unauthorised account. The attempted theft was detected and stopped before Jungkook suffered the full financial loss.



The operation reportedly relied on stolen personal information rather than a simple phishing message. Investigators said the group hacked websites and gathered information that could later be used to create mobile phone lines under victims’ names. The criminals allegedly intercepted authentication messages and used the information to gain access to bank, securities and cryptocurrency accounts. This made the scheme particularly dangerous because victims could lose access to valuable assets without knowingly clicking a suspicious link. Authorities described the operation as an unusually serious form of organised financial crime.


The numbers make the case even more startling. Jungkook’s HYBE shares targeted in the scheme were valued at approximately 8.4 billion won. Earlier reporting revealed that an unauthorised securities account had been created in his name and that thousands of shares were transferred. A portion was reportedly sold to a third party before legal action followed. BigHit Music took immediate steps to suspend the suspicious transaction and restore the affected holdings. A court later ordered the return of shares transferred to the third party, helping ensure that the attempted theft did not become a permanent financial loss.

The scale of the operation was far larger than Jungkook’s case. Investigators said the group targeted corporate chairmen, executives, entertainers, influencers and wealthy investors. Yonhap reported that the scheme was accused of causing about 380 billion won in losses, with 16 confirmed cases of actual financial damage reported in the court proceedings. The operation allegedly ran through overseas locations, including Thailand, while stolen information was used to access financial assets in South Korea. The wide range of victims helped authorities understand that this was an organised campaign rather than an isolated attack.

The Seoul Central District Court treated the case as a major financial crime. The court said the victims were targeted without fault and were placed in a vulnerable position by the criminals’ use of stolen information. It also stressed that the scale of the losses went beyond individual victims and posed a threat to confidence in the financial system. On August 20, 2026, the court sentenced the Chinese national identified in reports as the ringleader to 20 years in prison at the first trial. The ruling marked a major development in the long-running investigation.

The biggest twist in Jungkook’s story is that the attempted theft did not ultimately become a major financial loss. Once the suspicious activity was identified, BigHit Music and related parties acted quickly, including suspending payments and blocking the transaction. This intervention was crucial because the hackers had already gained access to information connected to the financial account. The incident later prompted additional security measures involving artists’ personal and device information. Jungkook’s case shows why rapid detection can be just as important as strong security when valuable financial assets are targeted.

The Jungkook case is a reminder that financial security does not depend only on protecting a password. Personal information, mobile authentication, identification details and account access can all become connected parts of a larger attack. The hacking group allegedly exploited several of these weaknesses to reach valuable assets. For ordinary users, the lesson is simple: monitor financial accounts, secure mobile numbers, protect identity documents and respond immediately to unusual account activity. Jungkook’s experience also shows how fast action by financial institutions and companies can sometimes prevent a sophisticated attack from turning into irreversible damage.


Unlock insightful tips and inspiration on personal growth, productivity, and well-being. Stay motivated and updated with the latest at My Life XP.