SOMESING reported that an external hacking group stole foundation-held SSX tokens on January 27, 2024, then moved funds to exchange and non-exchange wallets. The team worked with Uppsala Security to trace the token flow and asked domestic and foreign exchanges to freeze accounts or tag wallets associated with the attackers. It also reported the case to Korean police and KISA and submitted external forensic findings to DAXA. The source says the hacking path was still under investigation and withheld the threat-group name at that stage, so this notice should not be attributed to Kimsuky or another DPRK actor.