Hyundai Group’s Seoul offices were evacuated after an email threatened explosions unless a Bitcoin ransom was paid, authorities and media reports said.
The message demanded 13 Bitcoin — roughly $1.1 million — and set a deadline of 11:30 AM, prompting an immediate safety response across multiple company sites on December 20, 2025.
Threat Sent To Seoul Offices
According to police and news outlets, the email named two locations: the Hyundai Group building in Yeonji-dong, Jongno-gu, and the Hyundai Motor Group tower in Yangjae-dong, Seocho-gu.
Staff left work and buildings were cleared while local law enforcement mobilized special units. Reports have disclosed that Hyundai moved operations to remote work as officials searched the premises.
Police Clear Buildings After Sweeps
Bomb squads and officers combed rooms and public areas at both sites. Equipment was used and rooms were checked methodically. No explosives or suspicious devices were found, officials reported.
During the hours of searching, streets near the buildings were closed and entry was tightly controlled. No transfer of the demanded 13 BTC has been traced, and Hyundai did not pay the ransom, according to sources close to the company and law enforcement briefings.
Officers said the threat appeared aimed at causing alarm rather than reporting a verifiable plan. Investigators have been collecting digital evidence from the threatening email and are working with cyber units to trace its origin.
Searches of nearby surveillance footage and building logs were carried out as part of standard procedure. Several witnesses described the scene as tense, with employees escorted out calmly and officers coordinating safe movement.
Part Of A Wider Pattern Of Extortion
Based on reports from multiple outlets, this incident is not isolated. Similar threats have targeted major South Korean firms in recent days, with messages mentioning Samsung Electronics, KT, Kakao, and Naver.
Authorities believe some of the messages may be copycat attempts or coordinated extortion that rely on fear rather than real bombs. Officials said they are treating each tip seriously while trying to separate credible leads from hoaxes.
Financial and cybercrime units have noted an uptick in ransom demands tied to cryptocurrencies in the region over the past months. While attackers favor crypto for its cross-border reach, tracing transactions can sometimes reveal useful leads when firms and exchanges cooperate.
Analysts who follow such cases say investigators now routinely combine physical security sweeps with blockchain analysis to follow any money trail.
Hyundai released a brief statement confirming the evacuations and thanking emergency services for their fast response, but it declined to comment on investigative details.
Featured image from Unsplash, chart from TradingView
