According to the “KOK PLAY Token Analysis Report” from Core Security’s Digital Financial Crime Response Institute (DFCIA), obtained by Edaily on the 1st, as well as investigations by prosecutors and police, funds totaling 49,037 Ether (ETH)—amounting to approximately 105.3 billion won based on market prices at the time of the transfers—were siphoned from two Ethereum wallets registered under Ms. Jang’s name (a Bithumb Ethereum wallet and a Binance transaction history address) between October 2019 and November 2021.
Of this amount, 30,372 ETH (29,772 ETH on Bithumb, worth 50.5 billion won, and 600 ETH on Upbit, worth 2.8 billion won) flowed to domestic exchanges, while the remaining 18,665 ETH (7,628 ETH on Huobi, worth 19.3 billion won, and 11,037 ETH on Binance, worth 32.7 billion won) flowed to overseas exchanges.
The transfer of funds began in 2019, during the early stages of the KOK Foundation’s operations. According to the prosecution’s indictment, a total of 5 billion KOK coins were issued around September 10, 2019. One month later, from October of that year through March 2020, 14,605 ETH flowed from the KOKPlay app’s operational wallet and overseas exchanges such as HTX into a Bithumb Ethereum wallet registered under Mr. Jang’s name. These funds were transferred directly to Mr. Jang’s personal Bithumb deposit address without undergoing any separate money laundering process. The total amount transferred via this method was 15,080.13 ETH, worth approximately 3.05 billion won at the market rate at the time.
On March 9, 2021, an even larger-scale fund transfer was detected. Funds from the wallet used to operate the Cocoplay app passed through 10 intermediary wallets and were concentrated into Mr. Jang’s Binance confirmation address in just three hours (3:37 a.m. to 6:22 a.m.), totaling 34,177.5 ETH. These funds were entirely withdrawn by October 27 of the same year, leaving no balance remaining. A total of 15,292 ETH (approximately 50.3 billion won, across 41 transactions) was transferred through the domestic exchanges Bithumb (14,692 ETH) and Upbit (600 ETH), while the remainder flowed to overseas exchanges and six separate relay wallets.
As for overseas exchanges, 7,628 ETH (16,938,500 USD, approximately 19.3 billion KRW) was drained to Huobi (now HTX) between March 9, 2021, and September 2 of the same year. It was determined that a total of 11,037 ETH ($28,786,516, approximately 32.7 billion won) flowed to Binance between September 22, 2020, and October 5, 2021, combining both direct transfers and funds routed through intermediary wallets.
According to the indictment, Mr. Jang was a key figure who designed the establishment and business structure of the KOK Foundation in August 2019; he is believed to have initially registered the KOK corporation in the Seychelles, Africa, alongside Mr. Han, who has been identified as the mastermind. Mr. Jang is reported to have been responsible for managing the capital contributions received from victims and manipulating the market price of KOK tokens.
He was also directly involved in the token issuance phase; the indictment states that on September 10, 2019, he transferred two Ether from his cold wallet to the “KOK DEPLOYER” digital wallet, thereby issuing approximately 5 billion KOK tokens. Subsequently, the KOKPlay app was released, and fundraising from investors began in October 2019.
Previously, this newspaper reported evidence that funds totaling around 50 billion won were laundered through Chinese exchanges KuCoin and Huobi from a wallet believed to belong to Mr. A, who has been identified as the mastermind behind the embezzlement of funds following the acquisition of the KOK Foundation. Mr. A exchanged the coins for Tether (USDT) and cashed them out through overseas exchanges. (See Edaily, September 11: “[Exclusive] A Look Inside the KOK Mastermind’s Wallet… Over 50 Billion Won Cashed Out via Chinese Exchanges”)
Based on the findings from the analysis of Mr. Jang’s wallet, it is estimated that the KOK Foundation’s money laundering activities began in the early stages of the foundation’s establishment, even before Mr. A’s involvement. From October 2019—immediately after the foundation’s establishment—through March 2020, Mr. Jang transferred Ether received from wallets used to operate KokPlay out through Bithumb.
Subsequently, around April 2021—when the foundation was reportedly acquired by a Hong Kong-based entity—funds were concentrated in Mr. Jang’s Binance address and then fully transferred out through domestic and international exchanges. Considering that the cash-out of approximately 50 billion won via the wallet believed to belong to Mr. A began in July 2021, it appears that the money laundering scheme continued uninterrupted both before and after the change in the foundation’s management.
Park Jeong-seop, team leader, and Koo Si-hyun, principal researcher, at Core Security’s Digital Financial Crime Response Research Institute, who authored the report, stated: “It is presumed that domestic exchanges were also used for convenience, but the cash flows revealed so far represent only the tip of the iceberg compared to the total losses exceeding 2.5 trillion won,” they said. “If we investigate all funds that passed through intermediary wallets, the actual scale of victims’ funds siphoned off via Mr. Jang will likely be even greater.”
※ The “Crypto X-File Project for Reporting Digital Asset Fraud and Tax Evasion Whistleblowing” accepts online tips. Anyone—whether an individual, corporation, or institution—can submit a tip via the pop-up window or banner on the Edaily website.
