InvestReports disagree2 publishers2 min readPublished
Korean police turn to the FBI for logs that can test a Claude Code resume trail naming a Guangdong man
Korean police are seeking FBI help to obtain account and access-log data, since the 26-year-old in China named as the attacker may not be the one. The man denies any role, saying his phone number was stolen.
The Investor · Invest desk
A US security firm and AI company hold account data and access logs needed to confirm the attacker. The National Police Agency sent the FBI an official letter. Police are reviewing CrowdStrike's grounds and material on links to Chinese DDoS-for-hire groups. The man named denies a role.
- capability US security firm, AI company Hold account information and access logs needed to confirm the attacker's identity, claim 1
- decision National Police Agency With other domestic agencies, sent an official letter to the FBI; the joint-probe push went to higher authorities, claim 13
- exposure CrowdStrike Police are reviewing the US security firm's grounds for its identification, claim 7
- exposure Chinese DDoS-for-hire groups Police are reviewing material suggesting possible links to these groups, claim 7
- contradiction The man named Says he has nothing to do with the case and that his mobile phone number was stolen, claim 5
| Who | How | Kind | Claim |
|---|---|---|---|
| US security firm, AI company | Hold account information and access logs needed to confirm the attacker's identity | capability | 1 |
| National Police Agency | With other domestic agencies, sent an official letter to the FBI; the joint-probe push went to higher authorities | decision | 13 |
| CrowdStrike | Police are reviewing the US security firm's grounds for its identification | exposure | 7 |
| Chinese DDoS-for-hire groups | Police are reviewing material suggesting possible links to these groups | exposure | 7 |
| The man named | Says he has nothing to do with the case and that his mobile phone number was stolen | contradiction | 5 |
What happened
- Shinhan Bank, KB Kookmin Bank and Hana Bank are among seven financial companies with confirmed breaches, along with BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.
- The attacks were automated with AI tools, and the attacker is thought to have changed IP addresses as they ran.
- The National Police Agency and other agencies recently sent an official letter to the FBI, and the push for a joint investigation has been reported to higher authorities.
Why it matters
- constraint The records that could settle the identity sit with two US companies and come through a foreign agency, so the pace is set outside Korea.
- exposure A 26-year-old in Guangdong is identifiable in published reports by age and province, and he carries that suspicion until the records arrive.
- decision Police have two reviews open and a suspect committed to no one. They have not built a case against the Guangdong man.
CrowdStrike's lead rested on three details [11]. All three were entered by the attacker into Claude Code: the initials of a name, a Telegram account and a place of residence [4]. Set against them is the man's denial [5]. The attacker chose what to type. In our view that makes the CrowdStrike lead a pointer to where to look (or rather, a pointer to which logs to pull). According to en.sedaily.com, CrowdStrike only raised the possibility that the man was involved [3].
The data police want is account information and access logs [1]. The attacker is believed to have switched IP addresses during the attacks [9], so we'd expect each of the seven victims [8] to hold addresses that do not repeat, and the durable record of who opened an account, and from where, to sit with the vendors. Neither outlet discloses whether the security firm holding the data is CrowdStrike, which AI company is involved or when a reply is due.
The logs could match the account to the Guangdong man, in which case the original lead holds, our doubt is wrong and his denial is untrue. They could point to someone else. Police are working on that assumption [2]. Or they could lead to one of the Chinese groups that carry out DDoS attacks for hire, whose possible links police are already reviewing [7], and the individual would then matter less than the group.
The FBI step is the least verified part of the story. Yonhap's report rests on sources who spoke on condition of anonymity [16], and a police official said, "We cannot confirm specific progress, including whether cooperation is taking place." [15] En.sedaily.com reports that an official letter has already gone to the FBI [13], and it got a similar answer from a police official, who said, "Given the need to maintain trust with the partner country, we cannot confirm the progress." [14]
What to watch
- Whether the FBI request produces account and access-log records from the two US companies, and whether either company is named.
- Whether the police move from 'cannot confirm' to an on-record statement that the FBI is cooperating.
- Any finding on the Chinese DDoS-for-hire group links, or a formal clearing or charging of the Guangdong man.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The cooperation aims to secure data needed to confirm the attacker's identity, including account information and access logs held by a global security firm and an AI company based in the U.S.
ReportedSupportedSource: en.sedaily.com; Yonhap reports the same aim, naming account details and access logs of major U.S.-based cybersecurity and AI companies2 sources— create a free account to open themView cited source - [2]
A man in his 20s living in China was initially named as the attacker, but police are investigating on the assumption that the actual attacker could be someone else.
ReportedSupportedSource: en.sedaily.com2 sources— create a free account to open themView cited source - [3]
CrowdStrike raised the possibility that a 26-year-old man living in China's Guangdong Province was involved, based on resume details the attacker had entered into the AI coding tool Claude Code.
ReportedSupportedSource: en.sedaily.com2 sources— create a free account to open themView cited source - [4]
The clues used were the initials of the name the attacker typed in, a Telegram account and a place of residence.
ReportedSupportedSource: en.sedaily.com2 sources— create a free account to open themView cited source - [5]
The man claims he has nothing to do with the case, saying his mobile phone number was stolen, and the attacker's identity remains unconfirmed.
ReportedSupportedSource: en.sedaily.com; Yonhap also reports that the man denied involvement2 sources— create a free account to open themView cited source - [6]
Police are not treating any specific individual as the culprit and are investigating with all possibilities in mind.
ReportedSupportedSource: en.sedaily.com2 sources— create a free account to open themView cited source - [7]
Police are reviewing the U.S. security firm's grounds for its identification, as well as material suggesting possible links to Chinese groups that carry out DDoS attacks for hire.
ReportedSupportedSource: en.sedaily.com; Yonhap reports police are analyzing data used by CrowdStrike and documents suggesting ties to a Chinese DDoS attack group2 sources— create a free account to open themView cited source - [8]
Breaches were confirmed one after another at seven financial companies: Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital.
- [9]
The attacker is believed to have switched internet protocol addresses while running automated attacks using AI tools.
- [10]
Police have two reviews open at once: CrowdStrike's grounds for its identification, and material on Chinese DDoS-for-hire groups.
- [11]
The identification rested on three attacker-entered details (initials, Telegram account, place of residence) against one denial from the man named.
- [12]
South Korean police are working with the FBI to trace the hackers behind recent cyberattacks on the country's financial institutions, sources said Tuesday, Oct. 13.
ReportedContestedSource: Yonhap, citing anonymous sources4 sources— create a free account to open themView cited source - [13]
The National Police Agency and other related domestic agencies recently sent an official letter to the FBI and moved ahead with international cooperation procedures; the push for joint investigation has been reported to higher authorities.
ReportedContestedSource: en.sedaily.com, citing police and other sources4 sources— create a free account to open themView cited source - [14]
Asked whether police were specifically working with the FBI, a police official said, "Given the need to maintain trust with the partner country, we cannot confirm the progress."
ReportedContestedSource: A police official, quoted by en.sedaily.com4 sources— create a free account to open themView cited source - [15]
Asked to confirm ongoing cooperation with the FBI, a police official said, "We cannot confirm specific progress, including whether cooperation is taking place."
ReportedContestedSource: A police official, quoted by Yonhap4 sources— create a free account to open themView cited source - [16]
The sources who described the FBI cooperation spoke on condition of anonymity.
Sources
2 independent publishers whose own reporting we read for this story.
- en.sedaily.comPolice Seek FBI Help to Trace Financial Hacking Suspects
1 article · October 12, 2026
- en.yna.co.krPolice working with FBI to trace hackers behind recent cyberattacks
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- AI-Enabled AttacksFollow
- Cybercrime investigationFollow
- Financial Sector CybersecurityFollow