Ethereum

Solana

Impact

when

<p>Upbit has provided an update on the recent hack, admitting that gaps in its security processes played a role in the incident. The company accepted full responsibility and stressed that <em>‘there is no room for excuses.’</em></p>
<div class="in-brief">
 <div class="in-brief--container">
  <span></span> <span></span>
  <h2 class="in-brief--title" id="in-brief">In brief</h2>
  <ul>
   <li>Upbit openly acknowledged that flaws in its own wallet system played a role in its recent security breach, taking full responsibility for the lapse.</li>
   <li>The platform confirmed that the issue has now been fully resolved.</li>
   <li>Information from authorities suggests that the North Korean Lazarus hacking group is suspected to be behind the attack, echoing methods seen in a similar 2019 incident.</li>
  </ul>
 </div>
</div>
<h2 id="h-upbit-detects-weakness-in-wallet-system">Upbit Detects Weakness in Wallet System</h2>
<p>In its latest communication, Upbit explained that while investigating the $30 million theft detected on November 27, its team examined a large set of the exchange’s wallet transactions recorded on the blockchain and uncovered a flaw that made it possible for private keys to be worked out.</p>
<div class="my-4">
 <div class="ads ">
 </div>
</div>
<p>While the <a href="https://www.cointribune.com/en/tag/centralized-exchange-cex-en/" rel="noopener noreferrer nofollow">exchange</a> said the issue has now been resolved, the vulnerability only came to light during a comprehensive technical review, which was launched after unusual withdrawals were observed from Solana-related wallets.</p>
<div class="affiliate-button">
 <a href="https://okx.com/join/31971985" rel="noopener noreferrer nofollow">Start your crypto adventure safely with OKX</a> <a href="https://www.cointribune.com/en/sponsored-content/" rel="noopener noreferrer nofollow">This link uses an affiliate program.</a>
</div>
<blockquote class="wp-block-quote">
 <p><em>We analyzed numerous Upbit wallet transactions publicly disclosed on the blockchain, and discovered a security vulnerability that allowed us to deduce private keys (a type of password that allows access to blockchain wallet addresses and assets). We addressed this vulnerability.</em></p> <cite>Oh Kyung-seok, CEO of Dunamu</cite>
</blockquote>
<p>To prevent additional damage, Upbit halted all deposits and withdrawals and began tracking and freezing assets that had been moved away from the platform. The company noted that services will resume only when it is confident that the system has stabilized.</p>
<h2 id="h-asset-impact-and-reimbursement">Asset Impact and Reimbursement</h2>
<p>According to Upbit, the breach affected assets worth roughly 44.5 billion won ($30 million). Around 38.6 billion won ($26 million) belonged to customers, while approximately 2.3 billion won ($1.5 million) of that amount was frozen. The exchange’s own holdings made up the <a href="https://upbit.com/service_center/notice?id=5803&amp;view=share" rel="noopener noreferrer nofollow">remaining 5.9 billion won</a>. Upbit confirmed that every customer whose funds were involved has already been fully compensated using the exchange’s reserves.</p>
<p>Previous coverage from Cointribune highlighted that the intrusion occurred through one of Upbit’s hot wallets, while its cold wallet stayed untouched. The unusual activity was <a href="https://www.cointribune.com/en/upbit-suffers-major-solana-wallet-breach-vows-to-cover-all-losses/" rel="noopener noreferrer nofollow">detected at 4:42 a.m.</a> and involved several Solana ecosystem tokens, including Solana, Jupiter, Magic Eden, USDC, and other associated assets.&nbsp;</p>
<h2 id="h-upbit-breach-linked-to-lazarus">Upbit Breach Linked to Lazarus</h2>
<p>Upbit has activated emergency procedures across the company and is reviewing its security infrastructure. The exchange emphasized that protecting customer assets remains its top priority, while also noting that this incident highlights how no platform is completely immune to threats.</p>
<p>Meanwhile, information shared through the Yonhap News Agency revealed that the North Korean hacking group Lazarus is believed to be connected to the latest attack, according to government and business sources. In response, authorities plan to carry out an on-site inspection at the exchange to investigate further. Lazarus was also suspected of a previous Upbit attack in 2019, when about 58 billion won worth of <a href="https://www.cointribune.com/en/ethereum-2/" rel="noopener noreferrer nofollow">Ethereum</a> was stolen, and investigators say the techniques used then appear similar to those seen in the recent breach.</p>

Upbit Uncovers Wallet Vulnerability After $30M Hack

Table of Contents

Cointribune EN

Other articles published on Nov 29, 2025

Join our free newsletter for daily crypto updates!