The ring disguised illicit transfers as payments for cosmetic surgery and university tuition from 2021 to 2025.
• Funds passed through overseas crypto exchanges before operators converted them into Korean won through local bank accounts.
The operation reportedly ran from September 2021 to June 2025.
It exploited legitimate cross-border payments for services such as cosmetic surgery and education to disguise illicit foreign exchange transactions.
Overseas clients—primarily individuals seeking cosmetic surgery procedures or paying for university tuition in South Korea—transferred funds in foreign currencies, such as U.S. dollars and Chinese yuan, to the operators.
The operators converted the funds into crypto on overseas exchanges. They would then move the crypto to wallets in South Korea and sell it on local platforms for Korean won.
To further obscure the trail, perpetrators routed the funds through multiple domestic bank accounts under the guise of legitimate expenses.
The scheme averaged nearly $27 million annually, totaling 148.9 billion won over its four-year run.
The perpetrators leveraged sectors such as medical tourism and education, which naturally involve large and irregular international transfers.
This made the transactions appear routine and allowed them to evade early detection by financial authorities.
Despite South Korea’s strict crypto framework, including real-name banking rules and the Virtual Asset User Protection Act introduced in 2021.
Authorities say gaps remain in enforcing the FATF Travel Rule across virtual asset service providers.
The case has renewed calls for stronger due diligence in high-value service industries, renewed data sharing between agencies, and greater scrutiny of crypto “off-ramps,” where digital assets are converted into fiat currency.
Officials have also pointed to the potential role of a future central bank digital currency (CBDC) in improving transaction transparency.
Local reports say all three suspects are Chinese nationals, highlighting a direct link to China.
One suspect, a Chinese man in his 30s, allegedly played a central role in coordinating the operation.