Hyundai Group's Seoul office was evacuated after receiving an email threatening to explode unless a Bitcoin ransom was paid, according to authorities and media reports.
The message demanded 13 Bitcoins (approximately $1.1 million), set a deadline of 11:30 a.m., and prompted immediate security action on multiple company sites on December 20, 2025.
Threat sent to office in Seoul
According to police and media outlets, two locations were named in the email: the Hyundai Group Building in Yeonji-dong, Jongno-gu, and the Hyundai Motor Group Tower in Yangjae-dong, Seocho-gu.
Staff left the workplace, buildings were evacuated and local police mobilized special forces. According to reports, Hyundai Motor Co. has shifted its operations to remote work while authorities search its premises.
Police removed the building after clearing the area.
Bomb squad and police searched rooms and public areas at both sites. Equipment was used and rooms were systematically checked. No explosives or suspicious devices were found, authorities said.
During the hours-long search, roads near the building were closed and access was strictly restricted. According to sources close to the company and law enforcement, the requested 13BTC transfer was not tracked and Hyundai did not pay the ransom.
Officials said the threat appeared to be aimed at encouraging alarm rather than reporting a verifiable plan. Investigators are collecting digital evidence from the threatening email and are working with cyber units to trace its source.
As part of standard procedure, a search of nearby surveillance footage and building logs was conducted. Witnesses said the situation at the scene was tense, with employees calmly led away and officers coordinating safe movement.
Part of a broader pattern of extortion
Based on reports from multiple media outlets, this incident is not isolated. Similar threats have targeted major South Korean companies in recent days, with messages mentioning Samsung Electronics, KT, Kakao, and Naver.
Authorities believe some of the messages may be copycat attempts or organized extortion that rely on fear rather than real bombs. Officials said they treat each piece of information seriously, trying to distinguish between reliable information and misinformation.
The Financial and Cybercrime Division has noted an increase in ransom demands related to cryptocurrencies in the region over the past few months. Attackers prefer cryptocurrencies because of the potential for cross-border attacks, but when companies and exchanges work together, tracking transactions can reveal useful clues.
Analysts who track such cases say law enforcement authorities now routinely combine physical security checks with blockchain analysis to track the monetary trail.
Hyundai issued a short statement confirming the evacuation and thanking emergency services for their quick response, but declined to comment on details of the investigation.
Featured image from Unsplash, chart from TradingView
editing process for is focused on providing thoroughly researched, accurate, and unbiased content. We adhere to strict sourcing standards, and each page is carefully reviewed by our team of top technology experts and experienced editors. This process ensures the integrity, relevance, and value of your content to your readers.
