South Korean Men Jailed for Selling Gambling Sites to North Korean Hackers

Three South Korean men have been sentenced to prison for their involvement in a massive illegal gambling operation that relied on software developed by North Korean hackers. The case, which concluded at the Seoul Central District Court, revealed a sophisticated network where domestic criminals worked hand-in-hand with intelligence-linked entities from Pjöngjang. This collaboration not only violated gambling regulations but also posed a significant threat to national security, leading to convictions under the National Security Act for some defendants.

The operation was led by a man identified by his surname Kim, who had previously received a five-year sentence. On Thursday, November 12, 2026, his accomplices were handed their own sentences: one received four years, while two others were sentenced to three years each. The court emphasized both the social damage caused by illegal gambling and the gravity of providing financial support to North Korean intelligence operations. The developers involved were reportedly linked to Bureau 313 and the Reconnaissance General Bureau, two organizations central to North Korea's cyber warfare and intelligence gathering.

Numbers and facts

The scale of the enterprise was substantial. Between 2022 and 2024, the network managed to generate approximately 23.5 billion won (roughly $17.6 million) by selling 16 illegal gambling platforms to various operators in South Korea. The financial trail showed that over 7 billion won ($5.2 million) was transferred to the North Korean developers based in China. This amount represented about 30 percent of the total revenue. The NIS (National Intelligence Service) revealed that these developers often charged a flat fee of $5,000 to build a site and a monthly maintenance fee of $3,000.

Investigative records showed that the developers operated out of Dandong, a Chinese city bordering North Korea. They posed as Chinese software engineers to attract clients, but their true identity was eventually betrayed by their language. During more than 1,100 exchanged messages on platforms like Telegram, they used specific North Korean terms. The most notable was sonjeonhwa, the North Korean word for mobile phone, which differs from the South Korean hyudaepon. These linguistic slips provided prosecutors with the evidence needed to challenge the defendants' claims of ignorance regarding the developers' origins.

Background

North Korea has long been suspected of using its IT workforce abroad to generate hard currency for the regime, bypassing international sanctions. This case provides concrete proof of how illegal online gambling serves as a lucrative channel for these efforts. The software commissioned included a mobile version of the infamous slot game Sea Story, which has a history of causing social issues in South Korea. The developers did not just sell the code; they provided ongoing technical support and security management, essentially running the backend of the criminal enterprise from across the border.

"This is the first time that concrete evidence has been disclosed to the public that North Korea is deeply involved in cyber-gambling, which has recently become a serious social problem in South Korea." - Anonymous NIS Spokesperson

Why it matters for German players

This case serves as a stark warning for players in Germany about the dangers of the unlicensed gambling market. When users engage with offshore platforms that lack a GGL (Gemeinsame Glücksspielbehörde der Länder) license, they unknowingly risk their personal data and funds being used to support global criminal syndicates or hostile state actors. Under the German Interstate Treaty on Gambling 2021 (GlüStV 2021), only providers on the official Whitelist are legal. These regulated sites are monitored to ensure that player data is protected and that no malicious code—like the one found in the South Korean case—is embedded in the games.

Furthermore, German regulations include strict player protection measures such as the 1,000 Euro monthly deposit limit and the 1 Euro maximum stake per spin for online slots. These are enforced through the central LUGAS system to prevent problem gambling. Choosing an unlicensed site means forfeiting these protections and potentially becoming a victim of data theft, as seen in the South Korean investigation where personal info of over 1,100 individuals was compromised.

What it means for GGL-licensed casinos

For GGL-licensed casinos, maintaining high standards of software integrity is paramount. The South Korean case demonstrates that even seemingly legitimate software development outsourced to third parties can be infiltrated by malicious actors. Regulated operators in Germany must continue to audit their software supply chains and ensure that all games and platforms are certified by recognized testing labs. Integrity and transparency are the foundations of the legal market, and the strict oversight by German authorities remains the best defense against the type of infiltration described in these reports.