2025 AliExpress Korea — OTP exploit, 107 sellers, 8.6B won diverted
Data compromised
Seller account access; settlement funds diverted
Technical writeup
Hacker exploited OTP vulnerability in password recovery to reset passwords and alter settlement accounts for 83 of 107 affected sellers. 8.6 billion won ($6M USD) diverted. Detected Oct 16, confirmed Oct 24. No customer data compromised.
Root cause
OTP system vulnerability in account recovery