The person at the center of this case
Multiple financial institutions, cryptocurrency exchanges, and companies worldwide
Cold Case · Open
5 years waiting · since 2020
JON CHANG HYOK
Justice for Multiple financial institutions, cryptocurrency exchanges, and companies worldwide — the trail went cold in 2020, but the truth hasn't.
Start here
Key leads to think about
🎯
suspect
Lead #1What is Jon Chang Hyok's current location and is he still operating from North Korea or has he relocated?
🔍
evidence
Lead #2What specific malicious cryptocurrency applications did Jon develop and disseminate, and which exchanges were targeted?
👤
person
Lead #3Who are the other members of the Lazarus Group and APT38 conspiracy that worked directly with Jon?
Jon Chang Hyok is a North Korean state-sponsored hacker allegedly involved in a wide-ranging criminal conspiracy responsible for some of the costliest computer intrusions in history, targeting financial institutions and cryptocurrency exchanges. A federal arrest warrant was issued on December 8, 2020, charging him with conspiracy to commit wire fraud, bank fraud, and computer intrusions as part of the Lazarus Group and APT38 operations. He remains at large, believed to be in North Korea, and investigators seek information about his whereabouts and potential accomplices in this ongoing cyber threat.
Case
#1082
Federal Bureau of Investigation (FBI); United States District Court, Central District of California
Try asking
Claim this imported case
A one-time $10 claim transfers this imported case workspace to your account. You get 10 uploads for this case, 25 daily AI questions for this case, and public tips with files route to you.
10 uploads25 AI questions/day
This does not start a subscription. When the included limits are reached, the Personal plan unlocks more workspace capacity.
More leads to consider
Beyond the top three above — each detail below could be the thread that pulls this case open.
💡
clue
Lead #4What financial institutions suffered the greatest losses from these intrusions and what was the total value stolen?
Have information about any of these leads?
Even the smallest detail could be the key to solving this case.
Official wording
Source Narrative
Conspiracy to Commit Wire Fraud and Bank Fraud; Conspiracy to Commit Computer-Related Fraud (Computer Intrusion) Caution: Jon Chang Hyok is allegedly a state-sponsored North Korean hacker who is part of an alleged criminal conspiracy responsible for some of the costliest computer intrusions in history. These intrusions caused damage to computer systems of, and stole currency and virtual currency from, numerous victims.
Jon was alleged to be a participant in a wide-ranging criminal conspiracy undertaken by a group of hackers of the North Korean government’s Reconnaissance General Bureau (RGB). The conspiracy comprised North Korean hacking groups that some private cybersecurity researchers have labeled the “Lazarus Group” and Advanced Persistent Threat 38 (APT38).
For his part in the conspiracy, Jon is alleged to have been directly involved in the development and dissemination of malicious cryptocurrency applications targeting numerous cryptocurrency exchanges and other companies. On December 8, 2020, a federal arrest warrant was issued for Jon in the United States District Court, Central District of California, after he was charged with one count of conspiracy to commit wire fraud and bank fraud, and one count of conspiracy to commit computer fraud (computer intrusions).
Remarks: Jon is a North Korean citizen last known to be in North Korea. Jon has traveled to China in the past and has reported a date of birth in 1989.
Timeline of Events
🕵️
2020-12-08
Federal Arrest Warrant Issued
Jon Chang Hyok was charged with one count of conspiracy to commit wire fraud and bank fraud, and one count of conspiracy to commit computer fraud in the United States District Court, Central District of California
Key Locations
Interactive map showing important locations related to this case
Case Information
Incident:December 8, 2020
Last Updated:October 30, 2026
Leave a comment
Comments
Case Information
Incident:December 8, 2020
Last Updated:October 30, 2026