Upbit Hit by ₩54 Billion Hack, Commits to Cover Every Loss

Key Highlights:

• South Korea’s well-known cryptocurrency exchange Upbit has been hacked.
• Solana-based tokens worth 54 billion KRW have been transferred to unknown wallets.
• The platform will cover the losses from their own money.

Upbit, South Korea’s largest crypto exchange, has put a halt on deposits and withdrawals for affected Solana assets after confirming that tokens worth 54 billion KRW (around $36-37 million) have been transferred to unknown external wallet in an apparent hack that happened today, November 27, 2025. The exchange has already begun an emergency security inspection.

Details of the Hack

According to Upbit operator Dunamu, on November 27, 2025, at around 04:42 KST abnormal withdrawals were detected and they involved Solana network-linked assets that were moved from Upbit wallets to an unidentified external address.

As soon as the exchange learnt about the hack, as a first layer of defence it suspended the deposits and withdrawals for affected Solana services across its platform so that it could prevent any further unauthorized transfers while the scope of the breach is still being assessed.

This information has been provided through an official notice that was issued by Upbit’s operator Dunamu and signed by the CEO Oh Kyung-seok.

Moreover, in the notice it was also mentioned that the value of the affected tokens is somewhere about 54 billion KRW ($36-37 million at current exchange rates). Local reports describe that the event targeted the exchange’s hot wallet infrastructure for Solana-based tokens. More details on this may be published once the investigation is over.

Affected Solana Tokens

The breach has mainly targeted a group of tokens from the Solana ecosystem and includes popular tokens and some smaller meme/DeFi tokens.

In its announcement, Upbit said that coins like Solana (SOL) and others such as 2Z, ACS, BONK, DRIFT, HUMA, JTO, JUP, Magic Eden (ME), MEW, MOODENG, ORCA, PENGU, PYTH, RAY RENDER, SONIC, SOON, TRUMP, USDC, WOL and many more have been affected, basically a wide basket of Solana-linked tokens have been affected.

Instead of many small separate withdrawals from different users, the tokens have been pulled out all at once, as if from a single large wallet. This strongly indicates that one attacker got access to the exchange’s wallet permissions or system, and it was not a scene where multiple users were executing the hack.

As of now, blockchain investigators are following the trail with eagle eyes. They are tracking the addresses where the stolen crypto was sent so that the exchange can flag the wallets and try to freeze the funds before the attacker cashes out.

Immediate Response Measures

Upbit states that all remaining digital assets have been transferred from at-risk hot wallets to secure cold storage to block any additional abnormal movements. The exchange has also started “chain freezing” efforts by coordinating with Solana ecosystem projects and other platforms to tag the attacker’s wallet and limit laundering of the stolen assets.

The company has also launched a comprehensive investigation of its deposit and withdrawal systems and is preparing to cooperate with domestic and international law enforcement agencies. Upbit emphasizes that user balances will be fully honored, which means that any losses from the exploit

Outlook for Users and Markets

After the hack, Upbit immediately issued an official notice but there has not been a precise timeline provided as to when the normal functions of the platform such as the withdrawal and deposits will be resuming.

Internal trading of some assets may continue, but as of now, users cannot move affected Solana-based tokens on or off the exchange, which can break arbitrage activity and reduce liquidity across Korean exchanges, since traders may no longer be able to move assets easily between platforms.

One of the X users commented that even though this hack came as a surprise but Upbit’s decision to cover the loss from their own money is commendable and it is something that will build trust amongst its users.

Also this announcement also helped keep chaos at bay. The user also commented that a quick response also feels reassuring, even if it is a reminder that crypto funds can still be vulnerable on large and well-known networks.

Also Read: Upbit Suspension Paused as Court Grants Legal Stay