We Resolve Legal Matters
How can we assist you?
Blogs
More-
Crypto Hacking Response Guide: What to Do First After You Discover a Breach
1. What Should You Check First When You Discover You've Been Hacked? The first thing to determine is exactly how your crypto assets left your control. Even incidents that look like the same "crypto hacking" can involve very different response strategies and liability structures — a compromised exchange account, a leaked wallet seed phrase, and a fraudulent signature approved on a phishing site are not the same problem. So as soon as you confirm the loss, the first step is to identify which type of incident you are dealing with. Type of Incident What to Check First Immediate Response Exchange account compromised Login history, withdrawal history, whether 2FA settings were changed Request an account/withdrawal freeze Personal wallet compromised Whether the seed phrase or private key was exposed Consider moving remaining assets to a new, secure wallet Phishing site interaction The URL visited, and any signatures or token approvals granted Block further approvals/access and preserve evidence Malware/remote access Installed programs, access and execution logs Stop using the infected device and preserve evidence Exchange-side breach The exchange's incident notice, affected assets, and scope of damage Check the exchange's notice and claims procedure Identifying the type of incident first makes it much easier to determine what evidence to gather and who may ultimately be liable. In particular, if the loss occurred while using an exchange, it is worth checking not only how well you managed your own account, but also whether the exchange was properly safeguarding user assets. Under Article 7 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to keep their own assets separate from user assets and to actually hold the same type and quantity of virtual assets entrusted to them by users. In addition, the current Regulation on Supervision of Virtual Asset Business requires at least 80% of the economic value of user assets to be kept in an environment separated from the internet (cold storage). So if the breach occurred at an exchange, rather than concluding simply that "the account was hacked," it is important to work out exactly how authentication was carried out and which account or wallet the withdrawal came from, since this will affect how liability is ultimately determined. 2. What Should You Do Immediately to Stop Further Losses? Once you confirm the breach, the first priority is to stop any remaining crypto assets from being drained further. If the breach occurred on an exchange account, the first step is to contact the exchange's customer support or incident report channel to check whether login or withdrawals can be restricted. At this stage, don't stop at simply changing your exchange password — check whether other authentication methods, such as your email, phone number, or OTP, may also have been compromised. If the issue originated in a personal wallet, the seed phrase or private key itself may already be exposed. In that case, rather than continuing to use the same wallet, you should consider creating a new wallet in a verified, secure environment and moving any remaining assets there. That said, be careful about immediately resetting a compromised phone or computer. The device may still hold records — phishing site visit history, malware, login logs — that show exactly how the account or wallet was compromised. What to Check Immediately After a Crypto Hacking Incident Request a freeze on further withdrawals from the exchange account Check whether your password, OTP, or other authentication methods were compromised Review protective measures for any remaining crypto assets Avoid resetting the affected device without careful thought Preserve withdrawal alert emails, texts, and app notifications Save your exchange customer support inquiries and their responses What matters at this stage is not rushing into every possible action, but balancing preventing further damage with preserving evidence. At Decent Law Firm, in the initial consultation we first identify the structure of the incident — whether it involves a compromised exchange account, a compromised personal wallet, or phishing/remote access — and based on that, help determine what evidence should be preserved first and what should be requested from the exchange. 3. What Evidence Should You Secure After a Crypto Hacking Incident? Once you've stopped further losses, the next step is to gather as much evidence as possible showing how the stolen assets moved. In crypto cases, what matters most is not just a screenshot of the loss, but the transaction records showing exactly when the assets moved, from which address to which address. Where possible, try to preserve the following information in as close to its original form as possible. Evidence You Should Secure Date and time of the incident Type and quantity of the stolen crypto assets Value of the assets in Korean won at the time of the loss The withdrawal (sending) wallet address The receiving wallet address The TXID or transaction hash The exchange or wallet service used Login and access notifications OTP, phone, and email authentication records Password change notifications Records of exchange customer support inquiries The phishing site URL Related text messages, emails, and messenger conversations Information on any suspicious programs or apps Of these, the TXID and wallet addresses are the core evidence for tracing how the assets moved afterward. On public blockchains, a block explorer can be used to trace how assets moved from the initially compromised address to other addresses. Records kept internally by the exchange also matter. Under Article 9 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to retain transaction records — sufficient to trace, search, and verify transactions — for 15 years from the end of the transactional relationship. However, the fact that an operator retains transaction records is a separate question from whether a victim can immediately obtain all of the internal data they want. Login IP addresses, authentication data, withdrawal approval processes, and other internal system records may not be voluntarily disclosed by the exchange, and may need to be obtained through the proper legal process during an investigation. So before filing a report, it helps to separate what you can gather yourself now from what will need to be obtained later through the investigating authorities. At Decent Law Firm, based on the transaction history, TXIDs, wallet addresses, and exchange responses a victim has secured, we organize a chronological timeline of how the assets moved from the moment of the loss, and structure the facts and evidence so they can be used effectively in a police report or criminal complaint. 4. Can Crypto Assets Already Moved to Another Wallet Still Be Traced or Frozen? Even after crypto assets have moved to another wallet, it is sometimes still possible to trace the transaction path on the blockchain. However, being traceable and being actually recoverable are two different questions. On public blockchains, the transfer from the originally compromised wallet to another wallet remains on the record. So it is possible to check where the stolen assets moved afterward, and whether they show signs of having flowed into a domestic or overseas centralized exchange. In particular, if the assets are confirmed to have moved into a deposit address at an identity-verified centralized exchange, the account information and transaction records held by that exchange can become important evidence for an investigation. Factors to Check When Assessing Recovery Potential Factor What It Means Current custody wallet Whether the stolen assets still remain at that address Inflow to a centralized exchange Whether identity verification may be possible through an exchange account Further movement of assets Whether the assets were quickly split across multiple addresses Change of chain Whether the assets were moved to another network via a bridge Asset conversion Whether the assets were converted into a different crypto asset Use of an overseas operator Whether cooperation from a foreign exchange or international cooperation is needed That said, confirming that assets moved on the blockchain does not mean those assets can be immediately frozen. Reporting and freezing procedures differ from exchange to exchange, and actually freezing assets or obtaining account information may require legal process, such as a request from investigating authorities or a warrant. In addition, if assets have been split across multiple wallets, moved to a different chain, or converted into a different crypto asset, tracing and recovery become considerably more complex. So you should not assume either that "there is a blockchain record, so recovery is guaranteed" or, conversely, that "the assets already moved to another wallet, so recovery is impossible." At Decent Law Firm, based on the secured TXIDs and wallet addresses, we map out how the assets moved, and where there are signs that assets flowed into a specific exchange, we organize the material so that fact is clearly communicated to the investigating authorities. Where an overseas exchange is involved, we also consider that exchange's own damage-reporting and evidence-preservation procedures, along with whether international cooperation through Korean investigating authorities is needed. 5. What Is the Right Order for Filing a Police Report and Seeking Recovery? Once you have organized the facts of the loss and the basic transaction data, the next step is to consider filing a report with the investigating authorities. You can report hacking and other cybercrime damage through the Korean National Police Agency's Cybercrime Reporting System (ECRM), which asks you to specify the date and details of the loss and describe how the crime occurred. In crypto cases, rather than simply stating "my coins were hacked," it is important to organize and submit materials that let investigators immediately understand the structure of the incident. What to Organize Before Filing a Report 1) How the Incident Occurred Note the last time you used the account normally, and when you first noticed the unusual withdrawal. 2) The Assets Affected Summarize the type and quantity of crypto assets involved, and the total loss. 3) The Fraudulent Transaction Confirm the TXID and the sending/receiving wallet addresses. 4) Signs of Account Compromise Note any confirmed signs such as foreign IP access, password changes, OTP changes, or a compromised email account. 5) Movement of the Assets After the Theft If you can confirm the assets moved to another wallet or exchange, include that information as well. Organizing this information in advance helps investigators determine which exchange or business operator to seek records from, and what specifically to request. At Decent Law Firm, after organizing the facts of the incident and the asset movement history, we help specify the exchange accounts, access logs, authentication records, and wallet addresses that investigators will need to confirm during a criminal complaint or report. Even after an investigation begins, if new wallet addresses or signs of exchange inflow are identified, they should be organized as additional evidence and submitted. 6. Frequently Asked Questions (FAQ) Q1. My coins were moved to another wallet through hacking — can the transaction be reversed? Once a transfer is recorded on the blockchain, it is generally very difficult to reverse it the way you might cancel a bank transfer. So rather than trying to cancel the transaction itself, it is more important to identify the current location of the stolen assets and their transaction path, and check whether they have since flowed into an exchange. Q2. If the stolen coins moved to an overseas exchange, does that mean recovery is impossible? The mere fact that the assets moved to an overseas exchange does not mean recovery is impossible. That said, the required procedure and its difficulty can vary depending on the exchange's home country and policies, whether it holds user identity information, the current status of the assets, and the likelihood of cooperation with Korean investigating authorities. Q3. Should I immediately reset a phone or computer that was hacked? Taking steps to prevent further damage is necessary, but resetting the device unconditionally before all the case evidence has been secured requires caution. The affected device may still contain access logs, phishing URLs, malware, and other data showing how the breach occurred, so it is worth preserving the necessary evidence first before proceeding with safety measures. 7. Summary and Key Points If you experience a crypto hacking incident, the first priority is to stop any further withdrawals and secure evidence — TXIDs, wallet addresses, login and authentication records — that can help establish what happened. If the crypto assets have already moved to an external wallet, you should trace the path from the original fraudulent transaction onward, and where there are signs the assets flowed into a specific exchange, consider pursuing evidence preservation and a potential freeze through the investigating authorities. If the cause of the loss appears related to the exchange's own authentication or custody systems, it is also worth examining the exchange's legal obligations and the possibility of a damages claim. At Decent Law Firm, we review the transaction history, TXIDs, wallet addresses, and exchange usage records to reconstruct how the incident occurred and how the assets moved, and help build out the facts and evidence needed for a police report or criminal complaint. Where the stolen assets show signs of moving through domestic or overseas exchanges, we also look at the possibility of requesting evidence preservation or a freeze from the exchange, along with further steps through the investigating authorities, and where the incident relates to the exchange's security or custody obligations, we consider the full path toward recovery, including a damages claim. Because crypto assets can move through multiple wallets and exchanges in a very short time, once you confirm a loss, the priority is to organize whatever evidence you can secure right now, and to get help from a professional as soon as possible so you have the best chance of recovering your lost funds.
-
The CATFI Rug Pull Case and Unfair Trading Under Korea’s Virtual Asset User Protection Act
Meme coins often attract investors because they can be launched relatively quickly and may experience sharp price increases within a short period. Decentralized exchanges, or DEXs, facilitate trades through smart contracts and automated protocols rather than a centralized order-matching system. Once a token has been issued, trading can begin by creating a liquidity pool without going through the formal listing review typically required by a centralized exchange. This structure can attract investors seeking early exposure to newly launched tokens. At the same time, there has been growing concern over so-called rug pulls, in which project operators use false or misleading information to drive up the price of a token and then sell their holdings all at once. In May 2026, the Seoul Southern District Prosecutors’ Office indicted individuals involved in the issuance of the meme coin CATFI on charges including violations of Korea’s Act on the Protection of Virtual Asset Users. Prosecutors alleged that the defendants circulated false positive announcements, manipulated the token’s trading activity, and obtained unlawful profits. The case was the first in which prosecutors applied the Act’s provisions on fraudulent unfair trading. This article examines the laws that may apply to rug pulls and the key legal issues arising from such cases. Laws That May Apply to Rug Pull Schemes A rug pull is not a separately defined criminal offense under Korean law. Depending on how the scheme was structured, several provisions may apply. Where false disclosures, artificial trading activity, or market manipulation are involved, Article 10 of the Act on the Protection of Virtual Asset Users, which prohibits unfair trading practices, may become relevant. Category Main Conduct Relevant Provision Use of material non-public information A virtual asset service provider, issuer, or other relevant party uses undisclosed material information for trading Article 10(1) Market manipulation through matched or wash trades Parties coordinate transactions in advance or conduct trades without a genuine transfer of economic ownership Article 10(2) Market manipulation through actual trades Trades are carried out to induce others to buy or sell by artificially moving the market price Article 10(3) Fraudulent unfair trading A person uses fraudulent means, schemes, or deceptive practices, or makes false statements about material facts Article 10(4) If the parties behind a rug pull used multiple wallets to trade among themselves and artificially inflate transaction volume, Article 10(2) may apply. If investors were attracted through false lock-up announcements, fabricated social media engagement, or other misleading representations, Article 10(4) may also become relevant. A violation of these provisions may result in imprisonment for at least one year or a fine equal to three to five times the profit obtained or loss avoided through the violation under Article 19(1). Where the unlawful profit or avoided loss is at least KRW 500 million but less than KRW 5 billion, the offender may be sentenced to imprisonment for at least three years. Where the amount is KRW 5 billion or more, the punishment may be life imprisonment or imprisonment for at least five years under Article 19(3). Separate from criminal penalties, the Financial Services Commission may also impose an administrative surcharge in connection with unfair trading conduct. Administrative sanctions and criminal proceedings are legally distinct and may be pursued through separate procedures. The CATFI Case and the Legal Test for a Rug Pull According to the prosecution, the individuals involved in CATFI divided their holdings across multiple wallets and announced a lock-up plan on social media even though the promised restrictions were not actually observed. An influencer allegedly presented himself as an independent third party with no connection to the issuing group and encouraged investors to purchase the token. The defendants were also accused of using multiple wallets to create the appearance of active trading and rising demand. Once purchases by ordinary investors increased, they sold their holdings in a large-scale disposal. The token reportedly increased in value by approximately 1,001 times within 26 hours of issuance. Around 6,000 individuals purchased the token, and 256 investors were found to have suffered losses totaling approximately KRW 900 million. Prosecutors alleged that the defendants used approximately KRW 10 million in initial funds and obtained roughly KRW 400 million in sale proceeds. At the first trial hearing held on June 30, 2026, the defendants admitted the charges. Prosecutors requested a sentence of four years and six months for the influencer alleged to have led the scheme. However, a sharp decline in a token’s price or the failure of a project does not automatically establish a criminal rug pull. Virtual asset investments inherently involve price volatility. It is therefore necessary to distinguish between a genuine business failure and a scheme designed from the outset to deceive investors and extract funds. In practice, investigators may examine whether: ▪️ The parties had planned to sell their holdings before the token was issued or concealed the true amount held by the project team ▪️ Lock-up or token-burning plans were falsely announced, or holdings were distributed across multiple wallets to disguise common ownership ▪️ Trading volume and price movements were artificially created, followed by the closure of social media channels or online communities immediately after the sale Key Legal Issues and Response Options 🔹Criminal Liability of Influencers and Marketing Personnel A person does not avoid criminal liability simply because they did not personally issue the token. An influencer, marketing agency, or account operator may be investigated as a principal offender or an accomplice if they coordinated with the issuing group, published false information, or recommended the token while falsely presenting themselves as an independent third party. Relevant evidence may include: ▪️ Records showing that tokens were transferred to the promoter before the marketing campaign ▪️ Messages concerning the sharing of sale proceeds or trading profits ▪️ Records showing that promotional content was published despite knowledge that the information was false These materials may be important in determining whether the person merely provided advertising services or knowingly participated in the scheme. 🔹Options for Investor Recovery Article 10(6) of the Act on the Protection of Virtual Asset Users provides that a person who violates the unfair trading provisions may be liable for losses caused to users by the violation. Accordingly, investors may consider a civil claim for damages separately from any criminal complaint or prosecution. In practice, however, recovery may be difficult where the issuer operated through anonymous wallets. Identifying the responsible parties and proving a causal connection between the unlawful conduct and the investment loss can require a detailed review of both blockchain records and online promotional materials. Investors should therefore preserve relevant evidence as early as possible, including wallet addresses, transaction hashes, purchase records, social media posts, and announcements concerning lock-ups, listings, or partnerships. Decent Law Firm’s Virtual Asset Practice The CATFI case demonstrates that even where a meme coin is traded through a DEX, false announcements, coordinated trading, and artificial price movements may lead to liability under Korea’s Virtual Asset User Protection Act. It also shows that affected investors may need to consider both criminal proceedings and civil claims for damages. Decent Law Firm’s Virtual Asset Practice reviews on-chain transaction structures and blockchain fund flows in connection with rug pulls, market manipulation, criminal complaints, investigations, and civil damages claims. Where an investment loss appears to involve a rug pull or other unfair trading conduct, legal advice should be obtained at an early stage, beginning with the preservation and review of evidence. This content is provided for general informational purposes only and does not constitute legal advice for any specific matter.
-
Need Compensation for an Investment Scam?
Does Any of This Sound Familiar? ✔️ Cryptocurrency / Virtual Asset Scam Patterns You were invited to a high-return crypto investment group through social media or an open chat room. After making a small initial investment, you actually received profits. Once you invested more money, withdrawals suddenly became unavailable. The person in charge disappeared, or the investment platform itself vanished. ✔️ Stock Recommendation Service Scam Patterns It started as a free stock recommendation service. You initially made profits from recommended stocks. You were encouraged to join a VIP group or paid service. After paying hundreds or even thousands of dollars in fees, your losses continued to grow. If any of the above applies to you, there is a significant possibility that you have been the victim of investment fraud. Before blaming yourself, consider whether legal remedies may be available. Why Compensation May Be Possible — Legal Grounds Many victims ask: "I've already transferred the money. Can I still recover it?" In many cases, the answer is yes. Criminal Complaint (Fraud Investigation) Filing a criminal complaint can initiate an official investigation and enable law enforcement authorities to trace bank accounts and investigate criminal proceeds. In addition, asset-freezing measures such as preliminary attachment orders or payment suspension procedures under applicable financial fraud regulations may help prevent the dissipation of assets. Civil Damages Claim Victims may also pursue the return of their losses through civil litigation, either independently or alongside criminal proceedings. Where multiple individuals participated in the fraud, all participants may be held jointly liable under the principle of joint tort liability. This means that victims may seek recovery of the full amount of their losses from any one of the responsible parties. Furthermore, since the implementation of South Korea's Virtual Asset User Protection Act on July 19, 2024, the legal framework for responding to virtual asset-related fraud has become stronger than before. Why Legal Representation Matters Recovering losses from investment scams is difficult not because victims lack knowledge of the law, but because fraudsters deliberately conceal their tracks. Fraud organizations often: Split funds across multiple accounts Operate through multiple entities or shell companies Launder proceeds through virtual assets and overseas platforms As a result, a simple complaint or basic police report is often insufficient to uncover the full structure of the scheme. Even when a case is formally reported, investigations may end with "suspect unknown" or "insufficient evidence" unless the case is properly supported. Effective recovery efforts often require: Early evidence preservation strategies (chat records, bank transfers, platform screenshots, etc.) Experience working with virtual asset exchanges and tracing transactions Coordinated group actions involving multiple victims The ability to pursue both criminal and civil proceedings simultaneously Without an experienced virtual asset litigation team, navigating these processes can be extremely challenging. What Makes Decent Law Firm Different Decent Law Firm operates a dedicated team focused on virtual asset disputes and investment fraud cases. Attorneys who understand cryptocurrency exchanges, blockchain transactions, and digital asset investigations approach these cases from an entirely different starting point. Our Experience Includes: Cooperation with virtual asset exchanges and regulatory authorities Simultaneous criminal and civil recovery strategies Representation of groups of victims in collective actions Development of evidence preservation and recovery strategies tailored to victims In investment fraud cases, time is critical. The longer the delay, the greater the risk that assets will be dispersed and evidence will disappear. Prompt action can significantly improve the likelihood of recovery. One Thing You Should Do Right Now Preserve Your Evidence. Keep any materials you still have, including: KakaoTalk or messaging app conversations Bank transfer records Screenshots of investment platforms or applications Wallet addresses and account information Contact details of the individuals involved Even if the other party has disappeared, and even if the platform no longer exists, legal options may still be available. The sooner action is taken, the better the chances of protecting your rights and recovering your losses.
-
Accomplice Liability in Drug Cases Involving Privacy Coins: Dark Coins, Crypto Payments, and Investigation Risks in Korea
Why Are Privacy Coins Used in Online Drug Transactions? Monero (XMR), Zcash (ZEC), and similar assets are commonly referred to as privacy coins or “dark coins.” Unlike Bitcoin or Ethereum, where transaction records are generally visible on public blockchains, Monero is designed to make it difficult to identify the sender, recipient, and transaction amount through technologies such as ring signatures and stealth addresses. For this reason, Monero and other privacy-focused assets are sometimes used in online drug transactions, including transactions arranged through Telegram, dark web forums, and social media platforms. However, the fact that a transaction is difficult to trace does not mean that it is beyond the reach of law enforcement. Korean investigative authorities do not rely solely on on-chain transaction data. They may also review Telegram messages, mobile device forensic data, statements from sellers and buyers, exchange records, fiat conversion history, and other evidence to identify those involved in the transaction. In other words, privacy coins may make an investigation more complex, but they do not make an investigation impossible. Key Korean Laws That May Apply In drug-related cases involving privacy coins, multiple laws may apply depending on the person’s role and level of involvement. Legal Basis Main Conduct Covered Possible Penalty Narcotics Control Act, Article 60(1)2 Sale, brokerage, receipt, possession, or use of certain psychotropic substances, including substances classified under Schedules B or C Imprisonment for up to 10 years or a fine of up to KRW 100 million Narcotics Control Act, Article 58(1)3 Manufacturing, import/export, sale, brokerage, receipt, or possession for such purposes of Schedule A psychotropic substances Life imprisonment or imprisonment for at least 5 years Act on Reporting and Using Specified Financial Transaction Information Operating a virtual asset business without the required VASP registration Imprisonment for up to 5 years or a fine of up to KRW 50 million Act on Regulation and Punishment of Criminal Proceeds Concealment Concealing or disguising proceeds from drug-related crimes Imprisonment for up to 5 years or a fine of up to KRW 30 million Even if a person did not directly sell or possess drugs, liability may still arise if they connected buyers and sellers, facilitated payment flows, exchanged virtual assets, or helped conceal criminal proceeds. In addition, if a person operates an over-the-counter (OTC) virtual asset service without proper registration and the service is used to process drug-related funds, separate issues may arise under Korea’s anti-money laundering and virtual asset regulations. The applicable law and potential penalty will depend on the type of substance involved, the exact conduct, whether the conduct was repeated, whether any compensation was received, and whether the person knew or should have known the criminal nature of the transaction. Crypto-Related Drug Investigations Are Expanding in Korea Drug transactions in Korea are increasingly moving from offline channels to online platforms such as Telegram, dark web marketplaces, and social media. According to media reports citing Korean police data, from January to April 2026, 9.2% of all drug offenders were reported to have used virtual assets. This was higher than the annual figure of 8.4% recorded in the previous year. The proportion of online drug offenders has also continued to rise. Media reports indicate that the figure increased from 24.0% in 2021 to 42.0% during the January–April 2026 period. Korean authorities are also strengthening their investigative infrastructure. In 2026, the Ministry of Science and ICT and the Korean National Police Agency began promoting a project to develop an integrated investigation system linking dark web activity, virtual asset transaction tracing, and online drug advertisement monitoring. The police have also established dedicated virtual asset investigation teams in major regional police agencies, including Seoul, Busan, Incheon, Gyeonggi Nambu, and Gyeongnam. As a result, crypto-related drug investigations in Korea are no longer limited to the question of whether a coin transaction can be traced on-chain. Investigators may analyze online communications, wallet and exchange records, fiat conversion records, device forensics, transaction patterns, and statements from co-suspects together. Using a Privacy Coin Does Not Prevent Accomplice Liability In a Korean drug investigation, the key issue is not simply the payment method. The more important question is how the person was involved in the drug transaction. The Narcotics Control Act does not only punish direct sales. It may also punish inducement, solicitation, brokerage, receipt, possession, use, importation, and manufacturing, depending on the substance and conduct involved. For example, methamphetamine is generally treated as a Schedule B psychotropic substance under Korean law. If a person sells, brokers, receives, possesses, or uses methamphetamine, Article 60(1)2 of the Narcotics Control Act may apply, which provides for imprisonment of up to 10 years or a fine of up to KRW 100 million. If the case involves importation or manufacturing of methamphetamine, a more serious provision may apply. Under Article 58(1)6 of the Narcotics Control Act, manufacturing or importing/exporting certain Schedule B psychotropic substances may be punishable by life imprisonment or imprisonment for at least 5 years. This means that the applicable charge can vary significantly depending on whether the conduct involved simple use, possession, sale, brokerage, aiding and abetting, importation, or manufacturing. Therefore, if you are contacted by Korean law enforcement, the first question should not be “Which coin was used?” but rather “What specific charge is being investigated?” Why “I Only Introduced the Parties” May Not Be Enough In many cases, suspects say: “I did not sell the drugs myself.” “I never touched the drugs.” “I only shared a Telegram link.” “I only helped connect two people.” However, Korean drug laws do not only target the final seller. If a person connects a buyer and a seller, directs someone to a sales channel, shares sales posts, helps arrange payment, or receives a commission after the transaction, the conduct may be viewed as brokerage or aiding and abetting. The following circumstances may increase legal risk: Repeatedly sharing Telegram channel links Connecting potential buyers to sellers Receiving a commission after a transaction Receiving the commission in Monero or another virtual asset Maintaining repeated contact with buyers or sellers Being named in a statement by an arrested seller or buyer In particular, receiving compensation in a privacy coin may be interpreted as an attempt to avoid detection. As a result, saying “I only introduced the parties” may sometimes help explain limited involvement, but it can also be used as evidence that the person knowingly participated in the transaction structure. What Evidence Do Korean Investigators Review? In privacy coin drug cases, Korean investigators generally do not rely on blockchain data alone. They may review the following types of evidence. First, they may review Telegram, KakaoTalk, Discord, or other messaging records. Even if the server is located overseas, messages, deleted data, files, images, contact information, and login records may be recovered through forensic analysis if a mobile phone or computer is seized. Second, they may rely on statements from co-suspects. If a seller or buyer is arrested first, the person may identify intermediaries, brokers, or payment facilitators during questioning. In that situation, even someone who was not present at the actual transaction may become a suspect. Third, they may review virtual asset and exchange records. Even if the privacy coin itself is difficult to trace, exchange registration records, deposit and withdrawal history, fiat conversion records, and transactions involving other virtual assets may still be reviewed. Fourth, they may assess repetition and compensation. A one-time message may be viewed differently from repeated introductions, repeated sharing of sales channels, or commission-based involvement. Whether the person received payment can significantly affect how the conduct is characterized. Before attending an interview, it is important to distinguish between what the investigators may already have and what the person’s actual role was. What to Check Before Attending a Police Interview If you are contacted by Korean law enforcement, it may be risky to immediately state, “I did not know,” or “I did not sell anything.” Early statements are later compared with police interview records, seized digital evidence, forensic results, and statements from co-suspects. If your statement changes or conflicts with other evidence, even limited involvement may be interpreted more unfavorably. Before attending an interview, you should check: The specific charge listed in the summons or notice Whether you are being treated as a suspect or a witness Whether your phone, computer, or other device has been seized The scope of Telegram, KakaoTalk, Discord, or other message records Whether any virtual asset wallet or exchange account was used Whether any seller or buyer has already been arrested Whether any commission or payment was received Whether there is evidence of repeated introductions or referrals Depending on these facts, the case may remain a witness interview, or it may develop into a full criminal investigation involving brokerage, aiding and abetting, or other drug-related charges. Once an interview date is scheduled, it is important to prepare a clear and consistent statement strategy in advance. Early Legal Response Matters in Privacy Coin Drug Investigations Using Monero or another privacy coin does not mean that a person is safe from investigation. Korean authorities are increasingly analyzing online drug transactions through Telegram records, virtual asset transaction structures, exchange and fiat conversion records, forensic evidence, and statements from co-suspects. In drug cases, the applicable law and penalty can vary significantly depending on whether the allegation involves use, possession, sale, brokerage, aiding and abetting, importation, or manufacturing. How you explain your role in the transaction, whether you received compensation, and how you respond to digital evidence and co-suspect statements may affect the direction of the case. Decent Law Firm’s criminal defense team assists clients in drug investigations involving virtual assets, digital forensic issues, and alleged accomplice liability. If you have received a police summons in Korea in connection with Monero, privacy coins, Telegram drug transactions, or virtual asset payments, it is important to review your situation before attending the interview. This content is provided for general informational purposes only and does not constitute legal advice for any specific case.
-
Bitcoin and Drug Transactions in Korea — Applicable Laws and Legal Considerations
This article explains the laws that apply when Bitcoin or other cryptocurrency is used as a means of transferring drug transaction payments, or when drug-related funds flow into a cryptocurrency over-the-counter (OTC) operation. It also outlines how Korean investigative authorities assess culpability and what legal issues arise in these cases. 1. How Cryptocurrency Becomes Linked to Drug Trafficking Bitcoin and other virtual assets have become increasingly exploited as a means of transferring drug transaction payments, primarily due to their perceived anonymity and the ability to send funds across borders instantly. A common structure involves a drug buyer depositing cash into an OTC channel, which then purchases Bitcoin and transfers it to a wallet address specified by the seller. Korean law enforcement has responded by establishing dedicated cryptocurrency investigation units to pursue these cases. In a recent large-scale operation, the Gyeonggi Southern Police Agency investigated a drug network operating through Bitcoin and Telegram over approximately one year, arresting 122 individuals and detaining 47 of them pending prosecution. 2. Applicable Laws and Penalties In cases where drug-related funds are traced through a cryptocurrency OTC operation, investigators do not limit their approach to a single charge. Multiple laws are applied concurrently as a combined offense. 1) Aiding and Abetting under the Narcotics Control Act (Criminal Act, Article 32) Even without directly purchasing, selling, or distributing narcotics, a person who facilitates the transfer of drug transaction payments via Bitcoin may be prosecuted as an accomplice. Korean police have confirmed that individuals who assist in drug distribution through online virtual asset transactions — without ever meeting the drug dealer — can be charged with aiding and abetting under the Narcotics Control Act. Under Article 58(1) of the Narcotics Control Act, the principal offender in a drug sale faces life imprisonment or a minimum of five years in prison. An accomplice, after the statutory reduction of one-half under Article 32(2) of the Criminal Act, may still face a minimum of two years and six months of imprisonment. This is not a minor charge. 2) Act on Reporting and Using Specified Financial Transaction Information (ARUSFTI) Violation Operating an unlicensed virtual asset exchange service for profit — without registering with the Financial Intelligence Unit (FIU) — constitutes a violation of Article 7(1) of the ARUSFTI, punishable under Article 17(1) by up to five years in prison or a fine of up to KRW 50 million. The key factor is "business continuity." Unlike a one-time transaction between acquaintances, repeated exchanges conducted for profit establish the commercial nature of the activity, making criminal prosecution far more straightforward for investigators. 3) Act on Regulation and Punishment of Criminal Proceeds Concealment (ARPCPC), Article 3 If a person transfers or converts funds while being aware — even vaguely — that those funds derive from illegal activity, this constitutes concealment or disguising of criminal proceeds. It is not necessary to know the specific nature of the crime. The penalty is up to five years in prison or a fine of up to KRW 30 million. 3. The Central Legal Issue: How Authorities Establish Criminal Intent The most common defense in cryptocurrency OTC cases is: "I had no idea the funds were related to drugs." However, Korean courts have consistently held that full knowledge of the specific crime is not required. "Such recognition is sufficient if the person was aware that the relevant property constitutes criminal proceeds as defined under the law — it is not necessary to know the specific type of crime or its concrete details." — Supreme Court of Korea, January 11, 2007, Decision 2006Do5288 In actual drug-related cryptocurrency cases, prosecutors and police have framed criminal intent in charging documents as follows: the suspect "transferred Bitcoin after recognizing and anticipating that the payment constituted the proceeds of narcotics transactions." This framing — recognition and anticipation — is how investigators establish what Korean law calls dolus eventualis (indirect intent, or awareness of probable consequences). The external circumstances investigators use to infer this intent include: Informal transaction structure: Conducting transactions through Telegram rather than a licensed exchange, receiving funds via anonymous bank deposits Abnormally high commission rates: Charging 10–16% per transaction, far exceeding standard exchange fees. Investigators treat this as compensation for the legal risk — effectively a premium for facilitating illegal activity No customer verification (KYC): Failing to confirm the identity, purpose, or source of funds from any counterparty Concentration of transfers to a single wallet: The majority of Bitcoin transfers flowing consistently to the same wallet address, later identified as belonging to a drug seller Continued operation after prior investigation: Resuming OTC operations after having already been investigated for a related matter When these factors are present in combination, investigators build the case that the suspect could not reasonably have been unaware of the illegal nature of the transactions. 4. How Korean Authorities Track Cryptocurrency Transactions The assumption that cryptocurrency transactions are untraceable is no longer accurate. Korean law enforcement employs sophisticated methods to follow the money. ▪️Blockchain Forensics and On-Chain Data Analysis Every Bitcoin transaction — its timestamp, wallet address, and amount — is permanently recorded on the blockchain and cannot be deleted. Once a drug seller's wallet address is identified, all wallet addresses that transferred Bitcoin to that address are immediately traceable, including OTC operators and their associated bank accounts. ▪️Exchange Warrants and Account Seizure Domestic cryptocurrency exchanges are required by law to provide account information, transaction records, and identity verification data upon receipt of a warrant. A single transaction routed through a Korean exchange is sufficient for investigators to identify a person. The Supreme Court of Korea ruled in December 2025 that seizure of Bitcoin held in exchange-linked wallets is lawful, further expanding the investigative reach of authorities in cryptocurrency-related cases. 5. Key Legal Considerations If You Have Been Contacted by Authorities ▪️Clarify the Scope of the Charges Early Aiding and abetting under the Narcotics Control Act, violations of the ARUSFTI, and violations of the ARPCPC each have different legal elements. Understanding which charges are actually in play — and designing a response strategy for each — should happen at the earliest possible stage. ▪️Objective Demonstration That Criminal Intent Was Absent Saying "I didn't know" is not a legal defense in itself. What is required is an objective and documented account of why the transactions could reasonably have appeared legitimate — including any deception by the counterparty regarding their identity or the purpose of the funds. Relevant materials may include messaging records, transaction logs, and contemporaneous communications. ▪️The First Police Interview Is Critical By the time investigators issue a summons, they have typically already obtained blockchain analysis results and financial records. Statements made in the first interview that are inconsistent with documentary evidence can be used to confirm the existence of criminal intent. It is strongly advisable to consult a legal professional and establish a clear statement strategy before attending any police interview. DECENT Law Firm — Virtual Asset Practice Group Cases involving Bitcoin and drug transactions in Korea sit at the intersection of criminal law, the Narcotics Control Act, financial regulation, and blockchain forensics. Each charge carries distinct legal elements and requires a tailored defense strategy. DECENT Law Firm's Virtual Asset Practice Group has hands-on experience handling virtual asset-related narcotics investigations from the initial investigation stage through to trial. If you have been contacted by Korean law enforcement or are uncertain about the scope of the allegations against you, we recommend seeking legal advice before your first interview. This article is intended for general informational purposes only and does not constitute legal advice for any specific case or individual situation.
-
Involved in a USDT Exchange Transaction in Korea?
Legal Risks of Crypto OTC Transactions, Money Laundering Allegations, and Accomplice Liability Some individuals become involved in USDT (Tether) exchange transactions in Korea believing they are simply helping with a private crypto transfer or OTC deal, only to later find themselves under investigation for fraud, money laundering, or violations of Korean financial regulations. In recent years, Korean investigative authorities have increasingly focused on crypto-based money laundering structures connected to voice phishing, investment scams, illegal gambling operations, and overseas criminal organizations. As a result, even participants who were not part of the original scam may become subject to criminal investigation if they are found to have handled, converted, or transferred suspicious funds. This article explains the key Korean laws, court precedents, and investigative standards commonly applied in USDT exchange cases involving alleged accomplice liability or concealment of criminal proceeds. Why USDT Is Frequently Used in Money Laundering Schemes USDT (Tether) is a stablecoin pegged to the U.S. dollar and is widely used because of its relatively stable value and fast cross-border transfer capability. However, these same characteristics also make USDT attractive to criminal organizations seeking to move or conceal illegally obtained funds. In Korea, investigative authorities have recently uncovered multiple cases where proceeds from voice phishing or investment fraud were converted into USDT and transferred to overseas wallets or cash-out channels. In March 2026, for example, Seoul Jungnang Police announced the arrest of 19 individuals involved in laundering fraud proceeds through USDT conversion schemes linked to overseas criminal groups, with approximately KRW 6 billion in criminal assets seized. Under Korea’s Act on Reporting and Use of Certain Financial Transaction Information (commonly referred to as the “Special Financial Transactions Act” or “Special Act”), anti-money laundering obligations primarily apply to registered Virtual Asset Service Providers (VASPs). As a result, OTC crypto transactions conducted privately between individuals often become a gray area where the participant’s knowledge and intent become the central legal issue. Major Korean Laws That May Apply 1) Fraud Accomplice Liability Under the Korean Criminal Act If a person is found to have participated in the movement, exchange, or delivery of funds obtained through fraud, Korean prosecutors may investigate whether that person acted as: a joint principal offender (co-principal), or an aider and abettor (accessory) under Articles 30 and 32 of the Korean Criminal Act. The key issue is whether the participant knowingly assisted the fraudulent scheme or merely engaged in what appeared to be an ordinary transaction. 2) Act on Regulation and Punishment of Criminal Proceeds Concealment One of the most commonly applied statutes in these cases is Korea’s Act on Regulation and Punishment of Criminal Proceeds Concealment. The law criminalizes conduct such as: disguising the acquisition or disposition of criminal proceeds, concealing the origin of criminal proceeds, or hiding or transferring criminal assets. In practice, converting fraud proceeds into cryptocurrency, cashing out USDT, or transferring funds through third-party wallets may all be viewed by investigators as potential money laundering activity. The central legal question is usually whether the person handling the transaction knew — or at least should have suspected — that the funds were connected to criminal activity. 3) Korean Special Financial Transactions Act (Crypto Business Registration Issues) Individuals who repeatedly exchange USDT or conduct OTC crypto transactions for commission-based profit may also face allegations of operating an unregistered virtual asset business. Korean authorities generally look at factors such as: repeated or continuous transactions, receipt of commissions or service fees, dealing with multiple counterparties, and operation resembling a commercial exchange service. A one-time transaction between acquaintances is treated differently from ongoing exchange activity conducted for profit. 4) Foreign Exchange Transactions Act In some cases, Korea’s Foreign Exchange Transactions Act may also become relevant. This typically arises where funds are transferred internationally, including situations involving overseas wallets, offshore entities, or cross-border settlement structures. If the transaction occurred solely between domestic parties using Korean won, investigators may focus more heavily on money laundering or crypto regulatory issues rather than foreign exchange violations. However, international transfer structures may trigger additional scrutiny. The Most Important Legal Issue: “Willful Blindness” or Implied Criminal Intent One of the most important legal concepts in these investigations is whether the participant had criminal intent — including so-called “willful blindness” or implied awareness. The Korean Supreme Court has ruled as follows: To punish a person for concealing criminal proceeds, it is sufficient that the person recognized the property as criminal proceeds in general terms; it is not necessary for the person to know the exact type or details of the underlying crime. — Korean Supreme Court Decision 2006Do5288, Jan. 11, 2007 This means that even if someone claims: “I did not know it was voice phishing money,” or “I thought it was related to tax avoidance or gambling,” criminal liability may still arise if the person recognized that the funds were likely illegal in some form. Importantly, Korean courts may separately recognize liability for concealing criminal proceeds even where accomplice liability for the original fraud itself is disputed. The two offenses are legally distinct. Factors Korean Investigators Commonly Use to Infer Criminal Awareness Investigative authorities do not rely solely on direct admissions. Instead, they often infer intent based on the overall transaction structure. Common factors include: ▪️Unofficial OTC Transaction Methods Transactions conducted outside registered exchanges or through private channels are often viewed as higher-risk structures. ▪️Repeated Transactions Repeated dealings using similar methods may be interpreted as evidence that the participant understood the suspicious nature of the activity. This may also support allegations of operating an unregistered crypto business. ▪️Excessive Commissions or Fees Receiving unusually high compensation compared to ordinary exchange fees may be treated as evidence of awareness of illegal risk. ▪️Lack of Identity Verification Transactions involving anonymous parties, unverifiable identities, or disappearing counterparties may raise additional suspicion. ▪️Blockchain Transaction Analysis Because cryptocurrency transfers are recorded on the blockchain, Korean authorities increasingly use blockchain forensic analysis to trace fund flows and identify links between victim funds and crypto wallets. Where several of these factors appear together, prosecutors may argue that the participant at least “implicitly recognized” the illegal nature of the funds. Defense Strategy: Explaining Why Criminal Awareness Did Not Exist In these cases, simply stating “I did not know” is rarely enough. Because Korean courts broadly recognize implied criminal intent, the defense must often demonstrate — through objective facts and evidence — why the person could not reasonably have recognized the funds as criminal proceeds. Important factors may include: how the relationship with the counterparty developed, why the transaction appeared legitimate at the time, whether there were objective warning signs, how the transaction was explained to the participant, and whether statements remain consistent with blockchain records and messaging history. Early-stage responses are particularly important because investigators often already possess substantial transaction data before conducting interviews. An inconsistent or poorly prepared initial statement may later be used to strengthen suspicions. In addition, allegations involving fraud accomplice liability, criminal proceeds concealment, crypto business registration issues, and foreign exchange violations each involve different legal elements. Identifying the actual scope of potential liability at an early stage is therefore critical. Decent Law Firm | Digital Asset & Crypto Investigation Team USDT-related investigations in Korea often involve complex issues extending beyond ordinary crypto transactions, including blockchain tracing analysis, accomplice liability, money laundering regulations, crypto compliance obligations, and foreign exchange law. At Decent Law Firm, our digital asset and crypto investigation team has experience handling cryptocurrency-related investigations from the initial investigation stage through criminal trial proceedings. If you have been contacted by Korean investigative authorities or are unsure about the allegations being raised, careful early-stage legal review is strongly recommended. This article is provided for general informational purposes only and does not constitute legal advice for any specific case.
