Upbit hack — November 2025

Upbit, South Korea's largest cryptocurrency exchange, detected unauthorised transfers out of a Solana hot wallet at about 04:42 on 27 November 2025 Korean time, which is 19:42 UTC on 26 November. Operator Dunamu said assets worth roughly 54 billion won had been moved to an address that was not one of its designated internal wallets. Dollar equivalents in reporting diverge: Decrypt, CoinDesk and Halborn put the loss at roughly $36 million to $37 million, while The Record reported about $30 million.

The assets taken were Solana-network tokens rather than a single coin. Decrypt listed SOL and USDC alongside BONK, MOODENG, TRUMP, SONIC, ACS, JTO, RAY and PENGU; other outlets referred only to Solana-network tokens generally.

Upbit has not published a technical root cause. It suspended Solana deposits and withdrawals, moved remaining hot-wallet balances to cold storage and began an emergency review of its other networks and wallets. It also coordinated with token issuers to freeze what could still be frozen, and a portion of Solayer's LAYER token was successfully frozen. Dunamu chief executive Oh Kyung-seok said the entire amount would be covered by Upbit's own holdings, with no impact on customer assets.

South Korean government officials told the Yonhap news agency that North Korea's Lazarus Group was likely responsible, pointing to the intrusion methods and the way the proceeds were laundered, and investigators were reported to believe the attacker hijacked or impersonated administrator credentials to authorise the transfers. Halborn has suggested that weak or predictable signing data could have allowed private keys to be derived from historical transactions, but states that this has not been proven to be the cause. That attribution has not been formalised in a charge or a designation. The breach fell six years to the day after Upbit's 2019 hot-wallet theft.