Police have arrested a 24-year-old Chinese hacker in Thailand and four others for hacking into online bank accounts and stealing more than 30 million yuan ($4.9 million), local media reported Thursday.

The primary suspect, Wang Yongfeng, had moved to Thailand after he was released from prison for attacking the Shanghai car plate auction system in 2009, according to a report in the Xinmin Evening News.

While overseas, he masterminded a scheme to infect individuals' computers with a specially-made Trojan horse virus that he could use to hijack their bank accounts.

During the rush preceding the Spring Festival this year, police received more than 2,000 reports from people who found all the money in their bank account had inexplicably been transferred when they tried to book train tickets online, police said at a press conference Wednesday.

In a typical case, a victim surnamed Li lost 3,600 yuan when he tried to buy a ticket that cost less than 1,000 yuan on the train ticket booking website. Police said many of the victims were migrant workers on their way back to their hometowns for holiday.

Similar cases happened when taobao.com, a major shopping website, launched a site-wide sale on November 11. Many victims filed complaints that the money in their bank accounts had been transferred to an unknown site when they tried to make a purchase.

Wang was able to accomplish these thefts with a Trojan horse computer virus that he hired two hackers to write for him. He spread the virus online. Once it infected an individual's computer, it would lay dormant until the computers owner used an online bank account to make a payment or money transfer. 

The virus could bypass anti-virus software and USB verification keys that banks issue to secure the customer's accounts online. It then hijacked the bank account and transferred its entire balance to accounts of a game run by Giant Interactive Group, a major online game operator.

The hackers controlled about 500 game accounts and used the money to pay for gear and game recharge cards, which they then sold online at a discount.

The game served as a way for Wang and his accomplices to launder the stolen money and made it difficult for police to follow. Police said their money laundering operation was composed of four layers, including prepaid cell phone cards and online game gear dealers. The money ended up in Thai currency.

Shanghai police officers arrested Wang in Bangkok, Thailand, with the help of local law enforcement on August 19. They confiscated 3 million yuan from Wang and the other suspects. They also seized a villa that Wang had bought in Thailand. The other four suspects were arrested in Tianjin, Guangdong Province and the Guangxi Zhuang Autonomous Region.

Wang was sentenced to 14 months in prison for masterminding an attack against the Shanghai car plate auction system in July 2009.

He and a friend surnamed Zhou hacked into 5,400 computers to attack the system during an auction to obtain a cheap plate.