Investigators have traced a co-ordinated cyber-attack that paralysed tens of thousands of computers at six South Korean banks and media companies to a Chinese internet protocol address, according to authorities in Seoul.

IP addresses, which are unique to each computer connected to the internet, can easily be manipulated by hackers operating anywhere in the world, and the investigation into who was behind Wednesday's attack and whether they were in China could take weeks.

Suspicion for the simultaneous shutdown is focused on North Korea, which has threatened Seoul and Washington in recent days over UN sanctions imposed for its 12 February nuclear test and is accused of waging similar cyber-attacks over the past four years.

The attack did not affect the government or military, and there were no immediate reports that customers' bank records were compromised. But it disabled scores of cash machines across the country, disrupting commerce and renewed questions about South Korea's internet security and vulnerability to hackers.

If the attack was carried out by North Korea, the purpose would seem to be to send a message – and a warning – to South Korea that Pyongyang is capable of breaching its computer networks.

On Thursday, only one of the six targets, Shinhan Bank, was back online and operating regularly.

South Korean investigators say there is no proof yet that the North was behind the attack. However, it took place as Pyongyang warned Seoul against holding joint military drills with the US that it considers rehearsals for an invasion.

North Korea also has threatened retaliation for sanctions imposed for the nuclear test, as well as its launch of long-range rocket in December. Pyongyang blames Seoul and Washington for leading the push to punish the North.

The Korean peninsula has remained in a technical state of war, divided by a heavily militarised border, since the foes signed a truce in 1953. Over the past decade, the two Koreas have engaged in deadly naval skirmishes in waters that both countries claim.

Increasingly, their warfare has extended into cyberspace. Seoul's intelligence services believes Pyongyang was behind six cyber-attacks between 2009 and 2012. Pyongyang, meanwhile, blamed Seoul and Washington for an internet shutdown that disrupted its network last week.

"If it plays out that this was a state-sponsored attack, that's pretty bald-faced and definitely an escalation in the tensions between the two countries," said James Barnett, former chief of public safety and homeland security for the US Federal Communications Commission.

Experts say signs do not point to Chinese hackers since Chinese hacking, either from Beijing's cyber-warfare command or freelance hackers, tends to be aimed at collecting intelligence and intellectual property – not simply at disrupting commerce.

China also is home to a sizable North Korean community, both North Koreans working in the neighbouring nation and Chinese citizens of ethnic ancestry who consider North Korea their motherland.

In 2011, computer security software maker McAfee said North Korea or its sympathisers were probably responsible for a cyber-attack against South Korean government and banking websites that year. The analysis also said North Korea appeared to be linked to a massive computer-based attack in 2009 that brought down US government sites. Pyongyang denied involvement.