Upbit Hit With $36m Solana Hot Wallet Breach Day After $10b Naver Deal

The breach occurred as Upbit’s parent company, Dunamu, sealed a $10 billion acquisition deal with Naver and plans an initial public offering in the US.

Update Nov. 27, 9:23 am UTC: This article has been updated to include comments from Trezor CEO Matej Zak.

South Korea’s biggest crypto exchange, Upbit, temporarily froze deposits and withdrawals on Thursday after detecting about $36 million in unauthorized outflows from a Solana-network hot wallet.

In an announcement, the exchange said the suspicious transfers were flagged around 4:42 am local time (7:42 pm UTC), prompting a shutdown of transfer services and a full security review of its supported crypto assets.

Upbit confirmed that the compromise was isolated to its hot wallet, highlighting that cold-wallet reserves remained untouched. The exchange moved its remaining assets into cold storage and initiated onchain freezing attempts.

The incident put fresh scrutiny on Dunamu, which had just announced a $10 billion acquisition deal with fintech giant Naver. It also revived memories of Upbit’s 2019 security breach, when the exchange lost nearly $50 million in an attack orchestrated by the North Korean hacking group, Lazarus.

🚨 ALERT: Upbit suspends deposits and withdrawals after $38.5M abnormal outflow on Solana network, reporting the assets were transferred to unknown wallet on Nov 27.Upbit confirms it will cover all losses. pic.twitter.com/28Eu61s1Tf

Upbit said it had suspended deposits and withdrawals across the platform as a precaution, a measure that will remain in place until it completes its security review. The freeze is not limited to Solana-based assets, as the company works to secure its systems and assess remaining risks.

Trading on the platform continues to operate normally, allowing users to buy and sell assets within the exchange. However, users cannot move funds on or off the platform while the review is ongoing.

The company also assured users that any balances lost as a result of the security incident will be fully covered by its reserves, emphasizing that no customer assets will be lost due to the breach.

Source: CoinTelegraph