Skip to content
Today
Sections

Invest Reports disagree2 publishers 2 min read Published Updated

Korean police turn to the FBI for logs that can test a Claude Code resume trail naming a Guangdong man

Korean police are seeking FBI help to obtain account and access-log data, since the 26-year-old in China named as the attacker may not be the one. The man denies any role, saying his phone number was stolen.

The Investor · Invest desk

Send a correction

Police test an ID built on attacker-typed clues What the identification rested on, the age of the man CrowdStrike said may be involved, and the reviews police have open.

The identification rested on 3 attacker-entered details: initials, a Telegram account and a place of residence. CrowdStrike raised the possibility a 26-year-old in Guangdong was involved. Police have 2 reviews open: CrowdStrike's grounds and material on Chinese DDoS-for-hire groups.

Police test an ID built on attacker-typed clues
FigureValueNoteClaim
Attacker-entered details the identification rested on3 detailsinitials, Telegram account, residence11
Age, per CrowdStrike26 years old3
Police reviews open2 reviews10

What happened

  • Shinhan Bank, KB Kookmin Bank and Hana Bank are among seven financial companies with confirmed breaches, along with BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.
  • The attacks were automated with AI tools, and the attacker is thought to have changed IP addresses as they ran.
  • The National Police Agency and other agencies recently sent an official letter to the FBI, and the push for a joint investigation has been reported to higher authorities.

Why it matters

  • What it limits constraint The records that could settle the identity sit with two US companies and come through a foreign agency, so the pace is set outside Korea.
  • Who's exposed exposure A 26-year-old in Guangdong is identifiable in published reports by age and province, and he carries that suspicion until the records arrive.
  • Who has to decide decision Police have two reviews open and a suspect committed to no one. They have not built a case against the Guangdong man.

CrowdStrike's lead rested on three details [11]. All three were entered by the attacker into Claude Code: the initials of a name, a Telegram account and a place of residence [4]. Set against them is the man's denial [5]. The attacker chose what to type. In our view that makes the CrowdStrike lead a pointer to where to look (or rather, a pointer to which logs to pull). According to en.sedaily.com, CrowdStrike only raised the possibility that the man was involved [3].

The data police want is account information and access logs [1]. The attacker is believed to have switched IP addresses during the attacks [9], so we'd expect each of the seven victims [8] to hold addresses that do not repeat, and the durable record of who opened an account, and from where, to sit with the vendors. Neither outlet discloses whether the security firm holding the data is CrowdStrike, which AI company is involved or when a reply is due.

The logs could match the account to the Guangdong man, in which case the original lead holds, our doubt is wrong and his denial is untrue. They could point to someone else. Police are working on that assumption [2]. Or they could lead to one of the Chinese groups that carry out DDoS attacks for hire, whose possible links police are already reviewing [7], and the individual would then matter less than the group.

The FBI step is the least verified part of the story. Yonhap's report rests on sources who spoke on condition of anonymity [16], and a police official said, "We cannot confirm specific progress, including whether cooperation is taking place." [15] En.sedaily.com reports that an official letter has already gone to the FBI [13], and it got a similar answer from a police official, who said, "Given the need to maintain trust with the partner country, we cannot confirm the progress." [14]

What to watch

  • Whether the FBI request produces account and access-log records from the two US companies, and whether either company is named.
  • Whether the police move from 'cannot confirm' to an on-record statement that the FBI is cooperating.
  • Any finding on the Chinese DDoS-for-hire group links, or a formal clearing or charging of the Guangdong man.

Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence50
Adoption
Not scored
Hype gap−10
Incentives
Not scored
Confidence55
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The cooperation aims to secure data needed to confirm the attacker's identity, including account information and access logs held by a global security firm and an AI company based in the U.S.

    Reported Supported Source: en.sedaily.com; Yonhap reports the same aim, naming account details and access logs of major U.S.-based cybersecurity and AI companiesView cited source
  2. [2]

    A man in his 20s living in China was initially named as the attacker, but police are investigating on the assumption that the actual attacker could be someone else.

    Reported Supported Source: en.sedaily.comView cited source
  3. [3]

    CrowdStrike raised the possibility that a 26-year-old man living in China's Guangdong Province was involved, based on resume details the attacker had entered into the AI coding tool Claude Code.

    Reported Supported Source: en.sedaily.comView cited source
  4. [4]

    The clues used were the initials of the name the attacker typed in, a Telegram account and a place of residence.

    Reported Supported Source: en.sedaily.comView cited source
  5. [5]

    The man claims he has nothing to do with the case, saying his mobile phone number was stolen, and the attacker's identity remains unconfirmed.

    Reported Supported Source: en.sedaily.com; Yonhap also reports that the man denied involvementView cited source
  6. [6]

    Police are not treating any specific individual as the culprit and are investigating with all possibilities in mind.

    Reported Supported Source: en.sedaily.comView cited source
  7. [7]

    Police are reviewing the U.S. security firm's grounds for its identification, as well as material suggesting possible links to Chinese groups that carry out DDoS attacks for hire.

    Reported Supported Source: en.sedaily.com; Yonhap reports police are analyzing data used by CrowdStrike and documents suggesting ties to a Chinese DDoS attack groupView cited source
  8. [8]

    Breaches were confirmed one after another at seven financial companies: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.

    Reported Supported Source: en.sedaily.comView cited source
  9. [9]

    The attacker is believed to have switched internet protocol addresses while running automated attacks using AI tools.

    Reported Supported Source: en.sedaily.comView cited source
  10. [10]

    Police have two reviews open at once: CrowdStrike's grounds for its identification, and material on Chinese DDoS-for-hire groups.

    Derived Supported
  11. [11]

    The identification rested on three attacker-entered details (initials, Telegram account, place of residence) against one denial from the man named.

    Derived Supported
  12. [12]

    South Korean police are working with the FBI to trace the hackers behind recent cyberattacks on the country's financial institutions, sources said Tuesday, Oct. 13.

    Reported Contested Source: Yonhap, citing anonymous sourcesView cited source
  13. [13]

    The National Police Agency and other related domestic agencies recently sent an official letter to the FBI and moved ahead with international cooperation procedures; the push for joint investigation has been reported to higher authorities.

    Reported Contested Source: en.sedaily.com, citing police and other sourcesView cited source
  14. [14]

    Asked whether police were specifically working with the FBI, a police official said, "Given the need to maintain trust with the partner country, we cannot confirm the progress."

    Reported Contested Source: A police official, quoted by en.sedaily.comView cited source
  15. [15]

    Asked to confirm ongoing cooperation with the FBI, a police official said, "We cannot confirm specific progress, including whether cooperation is taking place."

    Reported Contested Source: A police official, quoted by YonhapView cited source
  16. [16]

    The sources who described the FBI cooperation spoke on condition of anonymity.

    Reported Contested Source: YonhapView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. en.sedaily.com

    1 article · October 12, 2026

    Police Seek FBI Help to Trace Financial Hacking Suspects
  2. en.yna.co.kr

    1 article · October 12, 2026

    Police working with FBI to trace hackers behind recent cyberattacks

Topics and entities

Topics

Entities