Lithuanian Hacker Extradited to South Korea After $1.8M Crypto Theft via KMSAuto Malware

South Korea extradited a 29-year-old Lithuanian national accused of stealing about 1.7 billion won (~$1.8M) in cryptocurrency using KMSAuto, a malicious Windows activation tool. The National Office of Investigation (NOI) concluded a five-year, multi-country probe that found the malware — downloaded more than 2 million times between 2020 and 2023 — performed real-time memory/clipboard manipulation to swap destination wallet addresses during transactions. Investigators say the campaign compromised over 3,100 addresses worldwide and successfully intercepted roughly 840 transactions, netting the attacker ~1.7 billion won; eight South Korean victims reported combined losses of about 16 million won. The inquiry began after an August 2020 complaint about a stolen bitcoin. Law enforcement traced funds through exchanges in six countries, seized 22 devices from the suspect’s residence, worked with Lithuanian authorities, issued an Interpol red notice, and arrested him in Georgia before extradition to Korea. Authorities warned users to avoid unlicensed software, verify wallet addresses before sending funds, and be aware of wallet‑swapping malware. For crypto traders: the case highlights continued risk from address‑hijacking malware targeting users of pirated or third‑party tools, the importance of address verification practices (hardware wallets, address whitelisting, copy‑paste checks), and that coordinated cross‑border enforcement can recover leads and disrupt persistent malware campaigns.