More than half of the stolen assets were laundered through three crypto exchanges set up by the hackers themselves at a discount to Bitcoin and the rest were laundered through 51 different exchanges, the National Police Agency said.

The hackers infiltrated a crypto exchange where the Ethereum was being kept and stole 342,000 tokens, now valued at more than 1.4 trillion won ($1 billion), the police said in a statement.

It did not name the exchange but South Korea-based Upbit exchange said at the time it had detected the transfer of 58 billion won of Ethereum to an unidentified wallet.

A National Police Agency official declined to confirm the identity of the hackers, but South Korean media said police had identified them as the Lazarus and Andariel groups linked to the North's Reconnaissance General Bureau affiliated with its military.

The police said its findings were based on an analysis of Internet Protocol addresses used and the subsequent flow of assets. The probe was conducted in cooperation with the U.S. Federal Bureau of Investigation (FBI) and it was the first time North Korea had been identified as the source of a cyberattack on a crypto exchange in South Korea, police said.

In May, a panel of United Nations sanctions monitors said it suspected North Korea mounted 97 cyberattacks on cryptocurrency companies between 2017 and 2024 valued at about $3.6 billion.

Investigators traced 4.8 Bitcoin to a Swiss crypto exchange and recovered them in October and returned them to the Seoul-based exchange, today valued at about 600 million won, police said.

North Korea routinely denies involvement in cyber hacking or crypto heists.

($1 = 1,397.5400 won)

(Reporting by Jack Kim; Editing by Ed Davies)