Hyundai Group’s Seoul office was evacuated after receiving an email threatening an explosion unless a Bitcoin ransom was paid, authorities and media reports said.
The message demanded 13 bitcoins (about $1.1 million) and set a deadline of 11:30 a.m. for December 20, 2025, prompting an immediate security response to several company sites.
Threatening email sent to Seoul branch
According to the police and media, the email listed two locations: the Hyundai Group Building in Yeonji-dong, Jongno-gu, and the Hyundai Motor Group Tower in Yangjae-dong, Seocho-gu.
Employees left work, buildings were cleared, and local law enforcement mobilized special forces. According to reports, it was revealed that Hyundai Motors had switched operations to remote work as officials searched the site.
Police clean the building after cleaning
Bomb squad and police searched rooms and public areas at both sites. Equipment was used and rooms were systematically checked. No explosives or suspicious devices were found, officials said.
While the search was in progress, roads near the building were closed and access was strictly controlled. According to sources close to the company and law enforcement briefings, the requested transfer of 13 BTC was not tracked and no ransom was paid by Hyundai.
Police said the threats appeared to be aimed at causing alarm rather than reporting a verifiable plan. Investigators have been collecting digital evidence from the threatening emails and are working with the cyber unit to trace the source.
A search of nearby surveillance footage and building logs was conducted as part of standard procedure. Several witnesses described the scene as tense, with staff calmly escorted out and police officers coordinating their safe movement.
Part of a broader pattern of extortion
According to multiple media reports, this is not an isolated incident. Similar threats have recently targeted major Korean companies, with messages mentioning Samsung Electronics, KT, Kakao, and Naver.
Authorities believe some of the messages may be copycat attempts or organized extortions that rely on fear rather than actual bombs. Officials said they are treating each tip seriously, trying to separate credible leads from fraud.
The Financial and Cybercrime Department has noted an increase in ransom demands related to cryptocurrencies in the region over the past few months. Although attackers prefer cryptocurrencies for their cross-border reach, there are times when transaction tracking can provide useful clues when companies and exchanges work together.
Analysts who track these cases say investigators are now routinely combining physical security searches with blockchain analysis to trace the money trail.
Hyundai issued a brief statement confirming the evacuation and thanking emergency responders, but declined to comment on the investigation.
Featured image from Unsplash, chart from TradingView
editing process for focuses on providing thoroughly researched, accurate, and unbiased content. We adhere to strict sourcing standards, and each page is diligently reviewed by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of the content for readers.
