"Your device is no longer under Samsung's protection. To restore functionality, pay 0.5 BTC to this wallet within 48 hours. Otherwise, your phone will broadcast all unencrypted data from the past 30 days to your contacts, employer, and local authorities."

But he didn't buy a new Samsung.

Jae-ho panicked. He wiped the phone. He re-flashed stock firmware via Odin. But the ransomware persisted — it was now inside the bootloader itself. Samsung’s official unlock tool refused to overwrite a "rogue" device.