South Korea’s Financial Supervisory Service has initiated sanctions against Dunamu, the operator of the crypto exchange Upbit, due to a significant hack in November 2025 that resulted in the loss of approximately $30 million from a Solana-based hot wallet. This recent action marks the official commencement of a possible landmark regulatory case in South Korea, which is known for being a vibrant hub for cryptocurrencies.
What led to the investigation and its findings? The breach occurred on November 27, 2025, when cybercriminals accessed Upbit’s Solana hot wallet. The total financial impact was estimated between 30 to 37 million dollars, equating to about 44.5 billion won, with roughly 38.6 billion won associated with customer assets.
The Financial Supervisory Service conducted a thorough investigation over seven months and uncovered various security deficiencies at Upbit. Chief among these issues was the manner and speed with which the exchange disclosed the incident to its users and the public. In response to the breach, Upbit committed to reimbursing customer losses from its own resources and has successfully traced and frozen around 2.3 billion won, which is about $1.5 million, of the stolen funds.
Authorities in South Korea suspect that the attack could be linked to the Lazarus Group, a state-sponsored hacking operation associated with North Korea. This situation highlights potential gaps in South Korea's regulatory framework, as current crypto regulations do not impose specific penalties for security lapses at virtual asset exchanges. Any sanctions imposed on Dunamu will require approval from a sanctions committee, which will also take into account reviews from related financial authorities.
It is noteworthy that this incident represents the second major breach of Upbit’s hot wallet in just six years, raising questions about the effectiveness of the exchange's security measures and the overall regulatory standards governing cryptocurrency operations in the region.