In a significant security breach that shook the crypto community, Upbit, South Korea’s leading cryptocurrency exchange, was forced to suspend all digital asset deposits and withdrawals on November 27, 2025. The exchange detected unauthorized transactions originating from its Solana network wallets, leading to an alarming loss of around 54 billion won, equivalent to roughly $37 million.
The breach was identified at approximately 4:42 AM local time, as operations noticed irregular withdrawal activity from a compromised hot wallet. In light of this troubling discovery, Upbit immediately took action to secure their systems and prevent further losses.
Dunamu, the parent company of Upbit, confirmed the incident through CEO Oh Kyung-seok, who publicly apologized to the user base for the disruption of services. The breach notably affected several Solana-based tokens, including meme coins such as BONK, as well as decentralized finance assets like JTO and USDC. This broad range of compromised tokens highlights the vulnerability of even popular assets in a dynamic market.
Security Measures and Reimbursement Plan
In response to the breach, Upbit acted swiftly by transferring all remaining digital assets to cold storage to mitigate potential further risks. This practice of keeping cryptocurrencies offline is a best practice in the industry for protecting assets from network vulnerabilities.
Additionally, the exchange cooperated with law enforcement agencies to execute on-chain freezing measures, successfully freezing approximately 12 billion won, or around $8 million, worth of related tokens. Upbit is actively collaborating with other token projects to assess the scope of the breach and attempt further asset freezes.
While the investigation is ongoing, Upbit has committed to fully reimbursing all affected customers using its own assets. This proactive reimbursement plan is intended to ensure that customers do not bear any financial losses due to the breach, reinstating trust among users wary of the platform’s security.
Furthermore, Upbit has initiated a comprehensive security audit of its entire digital asset transfer systems. Withdrawal services will only resume once the exchange confirms that its systems are secure. Until then, both deposit and withdrawal functions remain suspended as a precautionary measure.
This security incident comes at a tumultuous time for Upbit’s parent company, Dunamu, which is navigating a significant corporate transition. Just one day prior, Naver Financial announced it would absorb Dunamu in a monumental $10.29 billion all-stock deal. This transaction, pending regulatory approval, would see Naver issuing new shares for every Dunamu share, spotlighting a critical moment in the corporate landscape of the South Korean crypto market.
As the crypto sector continues to grow, incidents like this serve as a stark reminder of the importance of robust security measures. Upbit’s handling of the situation— from immediate asset freezing to full customer reimbursement— will be keenly observed by industry participants and may hopefully lead to enhanced security protocols on exchanges moving forward.
