South Korea’s Upbit hack puts spotlight on Solana security and exchange safeguards

• About 54 billion won in tokens moved to an external wallet on Nov. 27.
• Around 12 billion won in Solaire tokens have been frozen so far.
• The breach coincided with Dunamu’s major merger plans with Naver.

Upbit, South Korea’s largest crypto exchange, is carrying out extensive security inspections after an early-morning breach on Nov. 27 led to unauthorised transfers of Solana-linked assets worth about 54 billion won.

The exchange halted all deposits and withdrawals as it began moving digital assets to cold storage and initiated a broader internal review.

The incident has renewed attention on how Solana-based tokens are secured across trading platforms and has placed pressure on Upbit to strengthen systems as the company enters a major corporate transition involving its parent firm, Dunamu.

Solana assets targeted in early transfer

The breach took place at around 4:42 am on Nov. 27 when Solana network assets, including SOL, USDC, and other smaller tokens, were moved to an external wallet without authorisation.

Upbit described the activity as abnormal withdrawals connected to the Solana network.

The exchange confirmed that roughly $37 million worth of digital assets had been affected.

Upbit immediately suspended services to stop further transfers.

It said it has identified the entire scale of the outflow and will fully compensate users by covering the amount with its own holdings.

Customer balances will not be touched as part of the reimbursement process.

To control risk, the exchange transferred assets to cold storage and started a systemwide inspection of its wallet operations, deposit channels, and withdrawal procedures.

These steps were taken to prevent any further unauthorised movement and to contain the situation while teams examined logs and asset flows.

System checks widen beyond the Solana network

Upbit said its investigation will not be restricted to the Solana ecosystem.

It is reviewing the stability and security of the complete deposit and withdrawal infrastructure. This includes a detailed audit of network connections, wallet systems, and digital asset storage methods.

The exchange has begun an emergency sweep of internal processes and is carrying out a full evaluation of whether other networks require additional protections.

Deposits and withdrawals will resume gradually once the inspections conclude and the company is satisfied with system security.

The timing has amplified industry attention.

The breach occurred one day after Dunamu announced plans for a multibillion-dollar merger with Naver’s fintech arm.

The deal, valued at about $10.3 billion, represents one of the largest corporate moves in Asia’s digital finance landscape.

Reports suggest it may support Upbit’s ambitions for a future Nasdaq listing, creating pressure for the company to demonstrate resilience during a sensitive transition.

Freeze efforts expand as authorities prepare response

Upbit has started on-chain measures to track and freeze the affected assets.

It said around 12 billion won in Solaire tokens have already been frozen, and it continues to work with related projects and institutions to stop further movement.

The exchange is tracing the remaining funds through blockchain monitoring tools and coordinating with partners to identify additional freeze points.

Authorities and law enforcement agencies are also expected to join the investigation.

Upbit has prepared to cooperate with official inquiries once they begin and has asked users to report any verified information linked to the suspicious transactions.

The company acknowledged the disruption caused by the suspension of services and repeated that member assets remain protected.

It also stressed that the entire outflow will be covered using the exchange’s own resources.

Major merger plans heighten timing pressure

The breach took place on the anniversary of a major incident in Upbit’s history.

In 2019, on the same date, the exchange lost 342,000 ETH in another high-profile theft.

South Korean investigators later connected the event to North Korean hackers.

The stolen Ether has since increased in value to over $1 billion and remains one of the largest crypto heists associated with the country.

With deposits and withdrawals still paused, Upbit plans to restore services in stages after it completes its full review.

The exchange said its priority is to secure its infrastructure across all supported networks and to strengthen safeguards around Solana-linked assets while recovery and freeze efforts continue.