South Korean Men Sentenced for Supplying North Korean Hacking Services to Illegal Gambling Operations

A Seoul court has concluded legal proceedings against three South Korean men convicted of operating a sophisticated criminal enterprise that bridged domestic gambling operators with North Korean state-linked cyber developers. The Seoul Central District Court handed down sentences on November 12, 2026, with the alleged ringleader, identified by surname Kim, having previously received a five-year sentence. Two accomplices were sentenced to three years each, and a third defendant to four years in prison.

The investigation revealed a highly organized operation spanning 2022 to 2024 that generated approximately 23.5 billion won ($17.6 million) by selling 16 illegal gambling websites to South Korean operators. Of this total, more than 7 billion won ($5.2 million) - roughly 30 percent of proceeds - was transferred directly to North Korean developers. Prosecutors established that these developers maintained operational connections to North Korea's General Bureau 313 and Reconnaissance General Bureau, organizations formally associated with the country's intelligence and cyber operations infrastructure.

The operational structure demonstrated sophisticated division of labor. Kim allegedly initiated contact with North Korean developers operating from Chinese territory and commissioned custom gambling software, including a mobile version of the slot game Sea Story (also known as Bada Iyagi). Beyond initial platform development, the arrangement encompassed ongoing technical maintenance, security management, and system support. The two accomplices focused on sales and marketing, promoting the software to potential customers through X and Telegram by emphasizing the cost-efficiency of website establishment.

Prosecutors documented over 1,100 messages exchanged between Kim and developers across Telegram and other communication channels, predominantly addressing technical issues and requesting assistance. A critical evidentiary component emerged from linguistic analysis: one defendant claimed ignorance of the developers' North Korean origins, but prosecutors identified the use of 'sonjeonhwa' - a term distinctively used in North Korea to reference mobile phones - in communications between the defendants and developers. This linguistic evidence proved decisive in court proceedings.

Two defendants were convicted under South Korea's National Security Act alongside gambling-related charges, reflecting judicial concern about the geopolitical dimensions of the case. The third received conviction for operating illegal gambling facilities. Judges cited both national security implications and broader social harms from unregulated online gambling when imposing sentences.

This case exemplifies a persistent threat landscape that has drawn sustained attention from South Korean intelligence agencies. In 2024, the National Intelligence Service exposed a suspected North Korean software development operation in Dandong, China, where developers posing as Chinese nationals offered to construct illegal gambling websites for approximately $5,000, with monthly maintenance services priced at $3,000 additional. That operation reportedly employed 15 developers and connected to Bureau 39, an organization dedicated to generating revenue for the North Korean regime. The pattern reflects North Korea's strategic deployment of technical talent to monetize illicit gambling operations globally, creating complex enforcement challenges for regional regulators attempting to disrupt these transnational criminal networks.