In a dramatic episode on December 20, 2025, Hyundai Group’s offices in Seoul were put on high alert after an email threat claimed bombs would go off unless a ransom was paid in Bitcoin. The email demanded an alarming 13 Bitcoin, equivalent to about $1.1 million, setting a deadline of 11:30 AM for the payment, which triggered immediate safety protocols.
The threat specifically named the Hyundai Group building in Yeonji-dong, Jongno-gu, and the Hyundai Motor Group tower in Yangjae-dong, Seocho-gu, causing staff at both locations to evacuate swiftly. Local law enforcement agencies sprang into action, deploying special response units and temporarily converting operations to remote work while security personnel conducted thorough searches across company premises.
Swift Response from Authorities
With bomb squads and officers meticulously sweeping both office sites, officials utilized specialized equipment to check for explosives. Fortunately, after extensive scanning, no suspicious devices were found, and employees were escorted out safely amidst heightened tensions.
Traffic around the buildings was restricted, and law enforcement maintained tight control of access points throughout the investigation. Interestingly, there were no indications that the demanded 13 Bitcoin had been transferred, and sources report that Hyundai opted against paying the ransom.
Investigators later suggested that the threat appeared to be designed more to instigate fear than to fulfill an actual plan, prompting a focused effort in collecting digital evidence from the threatening email. Cyber investigation units are currently working to trace the email’s origins.
As standard procedure dictates, authorities conducted searches of nearby surveillance footage and building logs. Witnesses painted a picture of a calm yet tense environment as employees were evacuated in an orderly manner, with police coordinating their safe exit.
Extortion on the Rise
This incident is just one in a spate of similar threats that have recently targeted big South Korean corporations. Reports indicate that firms like Samsung Electronics, KT, Kakao, and Naver have also received such alarming messages in the past days.
While some of these communications may be copycat attempts, law enforcement is treating all threats seriously, aiming to discern credible leads from potential hoaxes. Law enforcement and cybercrime units have observed a notable increase in ransom demands linked to cryptocurrencies as attackers exploit the virtual currency’s cross-border advantages. However, tracing these transactions can often yield useful leads, especially when companies and exchanges cooperate.
In light of this trend, analysts have noted that investigations typically involve a combination of traditional physical security measures and blockchain analysis to uncover any financial trails left by perpetrators.
In a brief statement, Hyundai confirmed the evacuations and expressed gratitude towards emergency services for their prompt action but refrained from commenting on the ongoing investigations.
Featured image from Unsplash, chart from TradingView
