Top

Upbit suffers $30M breach, overshadowing Dunamu’s major merger announcement

Markets·November 28, 2025, 2:27 AM

South Korea’s largest crypto exchange, Upbit, suffered a security breach on Nov. 27 that resulted in the theft of 44.5 billion won ($30.4 million) in digital assets, all taken from the exchange’s hot wallets. The stolen tokens were all Solana-based, and Upbit CEO Oh Kyoung-suk said in a statement that no users will incur losses, as the company will cover the full amount with its own reserves.

https://asset.coinness.com/en/news/070b84bbeb9f3292d29e545818df0769.webp
Photo by FlyD on Unsplash

Hot-wallet breach hits 24 tokens

The exchange said in a statement that the compromised tokens were transferred to an unknown external wallet at around 7:42 p.m. UTC on Nov. 26. In total, 24 cryptocurrencies were affected, all within the Solana ecosystem. The stolen assets ranged from infrastructure tokens such as Solana (SOL) to staking-related assets like Jito (JTO), along with the stablecoin USD Coin (USDC) and memecoins including Bonk (BONK), Moodeng (MOODENG), and Official Trump (TRUMP).

 

According to Oh, the breach was followed by an emergency security review of the affected networks and wallets. He added that all remaining assets were moved to cold storage to prevent further unauthorized transfers. Oh also said the exchange is working to trace the stolen assets and block on-chain movements wherever possible, noting that Solayer (LAYER) tokens worth 2.3 billion won ($1.6 million) have already been frozen. Upbit is also reaching out to relevant projects and institutions for assistance.

 

This marks Upbit’s second theft case. The first took place on Nov. 27, 2019, exactly six years ago to the day, according to News1.

 

Authorities focus on Lazarus’ involvement

Financial authorities are investigating the incident, and North Korea’s Lazarus Group is being treated as the leading suspect, the Maeil Business Newspaper reported.

 

Lazarus is also believed to have been behind the 58 billion won ($40 million) worth of Ethereum (ETH) stolen from Upbit in 2019. A government official told the paper that the latest breach did not appear to stem from a server intrusion but may have involved a stolen administrator account, allowing the attackers to impersonate internal staff and move assets—similar to the method used in the 2019 case.

 

Security analysts echoed that assessment. One investigator said the stolen funds moved through exchange wallets before being mixed, a pattern often linked to Lazarus. He added that mixers, which are prohibited in Financial Action Task Force (FATF)-member jurisdictions, make tracing difficult and that attackers typically route assets through countries outside that framework, further pointing to North Korea.

 

Following the incident, Upbit suspended deposits and withdrawals for all assets and said services will resume once security is fully verified. The halt has also affected trading dynamics on the exchange, with CryptoQuant CEO Ki Young Ju noting that retail investors are fueling altcoin spikes as arbitrage bots remain offline.

 

Dunamu, Naver set $6.8B growth plan

The security crisis struck at a particularly sensitive moment for Upbit’s operator, Dunamu, overshadowing what was intended to be a celebratory corporate milestone. On that same day, Dunamu, Naver, and Naver Financial held a joint press conference to outline their global expansion strategy. Dunamu brings its blockchain and crypto infrastructure, Naver contributes its position as Korea’s dominant search engine, and Naver Financial adds its payment platform serving 34 million users.

 

The event came after reports that Naver Financial and Dunamu had approved a merger plan through a comprehensive share swap, with the ratio set at 2.54 to 1. The three companies said they will combine their respective strengths to invest 10 trillion won ($6.8 billion) over the next five years in building an ecosystem centered on Web3 and artificial intelligence (AI).


During the press conference, Naver CEO Choi Soo-yeon said no decisions have been made on a Nasdaq listing for the newly combined Naver Financial–Dunamu entity or on whether it might eventually merge with Naver, according to TechM. She said dual listings remain a matter requiring national consensus. Choi also noted that while Naver Financial is a Naver subsidiary, Dunamu is the larger partner, and a later merger between the combined entity and Naver is unlikely.

More to Read
View All
Policy & Regulation·

Nov 10, 2023

Korean Supreme Court acquits Dunamu Chairman Song Chi-hyung

Korean Supreme Court acquits Dunamu Chairman Song Chi-hyungThe Supreme Court of South Korea, in a significant ruling on Thursday (local time), acquitted Song Chi-hyung, chairman and principal stakeholder of Dunamu, of fraud and forgery charges, according to a report by local news agency Yonhap. This ruling is particularly noteworthy because Dunamu is the operator of the nation’s largest cryptocurrency exchange, Upbit.This decision, led by Justice Oh Kyung-mi, marks the culmination of a legal battle that began with Song’s indictment in Dec. 2018, and it extends to the acquittal of the company’s Chief Financial Officer (CFO) and the head of the Data Value Team, who were jointly indicted.Photo by Tingey Injury Law Firm on UnsplashBackground of the caseSong Chi-hyung and his colleagues were alleged to have fabricated an account on Upbit between September and November 2017. They had been accused of feigning the deposit of assets valued at KRW 122.1 billion and then employing these fictitious funds to enable transactions among actual members.The prosecution also leveled fraud charges against them, claiming that the fabricated account was utilized to sell 11,550 bitcoins to 26,000 members, thereby generating KRW 149.1 billion.The Seoul Southern District Court, acting as the court of first instance, found them not guilty. The court reasoned that the evidence presented by the prosecution was insufficient to establish that the defendants actually deposited the assets in the account.Issues with the prosecution’s evidence gatheringThe Seoul High Court, serving as the appellate court, identified problems with the evidence provided by the prosecution, determining that part of it lacked credibility due to improper collection methods. Notably, the court observed that the prosecution had directed Dunamu employees to access their Amazon cloud server to download the account’s transaction history. However, since this remote server was not included in the search and seizure warrant, the court highlighted the illegitimacy of the evidence.The appellate court also pointed out another issue with the evidence: documents stored on the CFO’s USB drive. The prosecution did not follow the legitimate search process, which requires them to extract only data related to the allegations. Moreover, the prosecutors did not present a warrant when confiscating the laptop of the Data Value Team’s lead, further undermining the credibility of their evidence.The court further stated that even if the remaining evidence provided by the prosecution was considered viable, it was still insufficient to substantiate the prosecution’s accusations.The prosecution, disagreeing with the decision of the appeals court, had escalated the case to the Supreme Court. However, the highest court in the nation sided with the ruling of the appeals court, effectively upholding the decision made at the appellate level.

news
Web3 & Enterprise·

Dec 18, 2023

Miracle Play and HAVAH team up to expand Web3 ecosystem

Miracle Play and HAVAH team up to expand Web3 ecosystemWeb3 e-sports tournament platform Miracle Play has signed a business agreement with the interchain platform HAVAH to exchange technologies and build a joint ecosystem, according to an official announcement on Miracle Play’s Medium page on Monday (KST).“With our interchain technology, we expect to play a pivotal role in the expansion and organic interoperability of the Web3 e-sports ecosystem, and we will actively cooperate with Miracle Play in building a leading ecosystem and infrastructure,” said Lim Young-kwang, CEO of HAVAH.Photo by Mateo on UnsplashNavigating the interchain landscape and blockchain gamingLaunched in January, HAVAH is an L1 interchain platform that allows users to freely move their digital assets across multiple blockchains. It features multiple decentralized applications (dApps) such as HAVAH Wallet and HAVAH Scan, and houses some 500,000 users.Miracle Play uses smart contract technology to ensure that anyone and everyone can hold various types of gaming tournaments in the form of PC, mobile and console games. It is currently in the open beta phase, with a cumulative participation rate of about 30,000 players. Although it is only supported on Polygon as of now, it will eventually be available on a total of nine major networks including Avalanche, XPLA, Solana and more, to facilitate cross-network gaming tournaments.Collaborative synergyThe two companies plan to collaborate on multiple fronts. Miracle Play will adopt HAVAH’s various mechanisms including the Mitter Protocol, which will allow the platform to implement one-click bridging services on the Miracle Play website and mobile app; as well as its interchain mechanism to bring multi-chain services to Miracle Play.HAVAH also aims to provide technical support for distributing and utilizing in-game rewards across networks on Miracle Play. Miracle Play tournaments will also be available via GameFi dApps in HAVAH’s ecosystem.“We will continue to work with companies in various fields to strengthen the interconnection of the blockchain ecosystem and expand the base of WEB3 Esport by making it conveniently accessible to everyone,” said Kim Hyun, CEO of Miracle Play.

news
Policy & Regulation·

Jul 24, 2023

Korea’s FSS to Collect Public Comments on Financial Statement Guidelines for Virtual Asset Entities

Korea’s FSS to Collect Public Comments on Financial Statement Guidelines for Virtual Asset EntitiesThe South Korean Financial Supervisory Service (FSS) has revealed a set of exemplary financial statements aimed at clarifying the disclosure requirements of virtual asset-related entities. These guidelines have been designed to align with the Korean version of International Financial Reporting Standards (K-IFRS), which was established by the Korea Accounting Institute (KAI).It was reported earlier this month that the Financial Services Commission (FSC) brought forward these regulations to tackle accounting uncertainties within the blockchain industry.The main goal of these exemplary guidelines is to help entities provide financial statement readers with essential information regarding virtual assets. This includes details about the reserve amount held by virtual asset issuers and information about the virtual assets held by virtual asset service providers (VASPs).Photo by Kelly Sikkema on UnsplashPresentation sessionsTo ensure effective dissemination and understanding of these guidelines, the FSS, KAI, and the Korean Institute of Certified Public Accountants (KICPA) have planned presentation sessions. These sessions will take place from July 26 to August 11, which will involve visits to VASPs, listed companies, and accounting firms. Valuable feedback and suggestions from these stakeholders are anticipated, as the events encourage open two-way communication and welcome participation from anyone interested.Discussion meetingsTo further refine the ideas put forward during the presentation sessions, two separate discussion meetings with experts are scheduled for September and October. The recommendations gathered from the industry will undergo a careful review by experts and be thoughtfully incorporated into the guidelines.The FSS will finalize the guidelines in cooperation with the FSC, and the Securities and Futures Commission under the FSC will review them and give approval for their implementation. This is expected to take place between October and November.The FSC has stated that these exemplary guidelines are currently in their preliminary stage and open to potential changes during the public comment period. Additionally, companies have the flexibility to make necessary adjustments to these practice guidelines to suit their specific needs and requirements.Issuers, holders, exchangesThe exemplary practice guidelines are specifically targeted at three types of entities: virtual asset issuers, virtual asset holders, and virtual asset trading exchanges.For virtual asset issuers, providing essential information about their virtual assets is a key requirement. This information should encompass their business models, accounting policies, obligations (e.g. whitepapers), and the current status of their projects. Such details should be disclosed in the annotations of their financial statements. Furthermore, revenue generated from the sales of virtual assets must be recognized, and any changes to their obligations should be duly noted. Moreover, disclosure of the reserved amount of issued virtual assets and their intended usage plan is mandatory.Companies holding virtual assets must provide information regarding accounting policies, the total value of assets held, the reasons behind their holdings, and any gains or losses incurred. Additionally, holders are obligated to disclose risks associated with virtual assets and their potential impact.Virtual asset trading platforms, such as exchanges, are mandated to disclose not only their own virtual asset holdings but also those held on behalf of their customers. This disclosure should encompass detailed information about their accounting policies, the total value of assets under their custody, associated risks, and the involvement of third-party custodians. In particular, the platforms must indicate whether they treat customer assets under their custody as assets or liabilities and provide a clear rationale for such classification in the annotations of their financial statements.

news
Loading