South Korean authorities have issued a warning to financial firms, including cryptocurrency exchanges, after detecting a surge in scanning attempts from North Korean internet protocol (IP) addresses. According to a report by Yonhap News Agency on October 28, 2026, the attempts began on October 21 and have continued since, with over 4.4 million access attempts logged by the time the notice was sent out.
The scanning-type access refers to efforts to identify vulnerabilities or open network ports that could be exploited in future attacks. The South Korean government urged companies to review their information security systems for any anomalies and report any suspicious activity linked to these IP addresses.
Despite the high volume of scanning attempts, no security breaches or damages have been reported so far, according to industry sources cited by Yonhap. The report marks the first official confirmation of North Korea's involvement in such activities targeting South Korea's financial sector.
The alert comes amid a series of hacking-related incidents in South Korea since late September, affecting entities like cryptocurrency exchange Bithumb and asset management firm Mirae Asset Global Investments.