The National Intelligence Service of South Korea has stated that it is collaborating with other parties to investigate the reasons behind the Orbit Bridge theft and the attackers.
According to Article 48, Section 3 of the South Korean Information and Communication Network Act, information and communication service providers are required to immediately report infringement incidents to the Ministry of Science and ICT or the Korea Internet & Security Agency. Therefore, in the early stages of the Orbit Bridge cryptocurrency theft incident, the Korea Internet & Security Agency and the National Police Agency analyzed the causes of the event.
Subsequently, the National Intelligence Service of South Korea also became involved in the investigation because the analysis indicated that the Lazarus hacking group from North Korea is likely the main perpetrator of this attack.