Top

Upbit suffers $30M breach, overshadowing Dunamu’s major merger announcement

Markets·November 28, 2025, 2:27 AM

South Korea’s largest crypto exchange, Upbit, suffered a security breach on Nov. 27 that resulted in the theft of 44.5 billion won ($30.4 million) in digital assets, all taken from the exchange’s hot wallets. The stolen tokens were all Solana-based, and Upbit CEO Oh Kyoung-suk said in a statement that no users will incur losses, as the company will cover the full amount with its own reserves.

https://asset.coinness.com/en/news/070b84bbeb9f3292d29e545818df0769.webp
Photo by FlyD on Unsplash

Hot-wallet breach hits 24 tokens

The exchange said in a statement that the compromised tokens were transferred to an unknown external wallet at around 7:42 p.m. UTC on Nov. 26. In total, 24 cryptocurrencies were affected, all within the Solana ecosystem. The stolen assets ranged from infrastructure tokens such as Solana (SOL) to staking-related assets like Jito (JTO), along with the stablecoin USD Coin (USDC) and memecoins including Bonk (BONK), Moodeng (MOODENG), and Official Trump (TRUMP).

 

According to Oh, the breach was followed by an emergency security review of the affected networks and wallets. He added that all remaining assets were moved to cold storage to prevent further unauthorized transfers. Oh also said the exchange is working to trace the stolen assets and block on-chain movements wherever possible, noting that Solayer (LAYER) tokens worth 2.3 billion won ($1.6 million) have already been frozen. Upbit is also reaching out to relevant projects and institutions for assistance.

 

This marks Upbit’s second theft case. The first took place on Nov. 27, 2019, exactly six years ago to the day, according to News1.

 

Authorities focus on Lazarus’ involvement

Financial authorities are investigating the incident, and North Korea’s Lazarus Group is being treated as the leading suspect, the Maeil Business Newspaper reported.

 

Lazarus is also believed to have been behind the 58 billion won ($40 million) worth of Ethereum (ETH) stolen from Upbit in 2019. A government official told the paper that the latest breach did not appear to stem from a server intrusion but may have involved a stolen administrator account, allowing the attackers to impersonate internal staff and move assets—similar to the method used in the 2019 case.

 

Security analysts echoed that assessment. One investigator said the stolen funds moved through exchange wallets before being mixed, a pattern often linked to Lazarus. He added that mixers, which are prohibited in Financial Action Task Force (FATF)-member jurisdictions, make tracing difficult and that attackers typically route assets through countries outside that framework, further pointing to North Korea.

 

Following the incident, Upbit suspended deposits and withdrawals for all assets and said services will resume once security is fully verified. The halt has also affected trading dynamics on the exchange, with CryptoQuant CEO Ki Young Ju noting that retail investors are fueling altcoin spikes as arbitrage bots remain offline.

 

Dunamu, Naver set $6.8B growth plan

The security crisis struck at a particularly sensitive moment for Upbit’s operator, Dunamu, overshadowing what was intended to be a celebratory corporate milestone. On that same day, Dunamu, Naver, and Naver Financial held a joint press conference to outline their global expansion strategy. Dunamu brings its blockchain and crypto infrastructure, Naver contributes its position as Korea’s dominant search engine, and Naver Financial adds its payment platform serving 34 million users.

 

The event came after reports that Naver Financial and Dunamu had approved a merger plan through a comprehensive share swap, with the ratio set at 2.54 to 1. The three companies said they will combine their respective strengths to invest 10 trillion won ($6.8 billion) over the next five years in building an ecosystem centered on Web3 and artificial intelligence (AI).


During the press conference, Naver CEO Choi Soo-yeon said no decisions have been made on a Nasdaq listing for the newly combined Naver Financial–Dunamu entity or on whether it might eventually merge with Naver, according to TechM. She said dual listings remain a matter requiring national consensus. Choi also noted that while Naver Financial is a Naver subsidiary, Dunamu is the larger partner, and a later merger between the combined entity and Naver is unlikely.

More to Read
View All
Web3 & Enterprise·

Nov 06, 2023

DeFi investment platform Allbit.com adds portfolio and analytics services

DeFi investment platform Allbit.com adds portfolio and analytics servicesBlockchain firm Ozys, announced on Nov. 3 (local time) that it has added portfolio and analytics services to its comprehensive Web3 financial investment platform Allbit.com.Photo by rc.xyz NFT gallery on UnsplashIntegration with KlaytnThe beta version of Allbit.com was launched in March, with a trading view chart displaying real-time prices of cryptocurrencies based on trades that are made on KLAYswap, a major decentralized finance (DeFi) protocol launched by Ozys. KLAYswap is built on Korean tech juggernaut Kakao’s open-source public blockchain called Klaytn.Newest features“Users of KLAYSwap and KLAYSTATION can now easily check the status of their on-chain activities without having to track them separately,” explained Ozys CEO Roi Choi.The “My Portfolio” feature on the recently updated platform gives users a convenient way to monitor their asset balances, the liquidity on KLAYswap, and the staking status of KLAYSTATION, a staking tool based on the Klaytn network. For better risk management, the “Net Asset Trend” graphically displays daily changes in the user’s net asset value. Additionally, the “PNL (ROI) Dashboard” provides insights into profit and loss by showing real-time and periodic performance data. Whether tokens are held in a personal wallet or deposited into a particular service, the dashboard tracks token price movements to present users with an up-to-date view of their investment returns.Allbit.com customers can also keep up with activities on various wallets and market trends through their personalized watchlists and share their portfolios with others.Choi added that Ozys plans to add more functions to Allbit.com in the future to enhance the user experience and optimize convenience.

news
Policy & Regulation·

Nov 10, 2023

Korean Supreme Court acquits Dunamu Chairman Song Chi-hyung

Korean Supreme Court acquits Dunamu Chairman Song Chi-hyungThe Supreme Court of South Korea, in a significant ruling on Thursday (local time), acquitted Song Chi-hyung, chairman and principal stakeholder of Dunamu, of fraud and forgery charges, according to a report by local news agency Yonhap. This ruling is particularly noteworthy because Dunamu is the operator of the nation’s largest cryptocurrency exchange, Upbit.This decision, led by Justice Oh Kyung-mi, marks the culmination of a legal battle that began with Song’s indictment in Dec. 2018, and it extends to the acquittal of the company’s Chief Financial Officer (CFO) and the head of the Data Value Team, who were jointly indicted.Photo by Tingey Injury Law Firm on UnsplashBackground of the caseSong Chi-hyung and his colleagues were alleged to have fabricated an account on Upbit between September and November 2017. They had been accused of feigning the deposit of assets valued at KRW 122.1 billion and then employing these fictitious funds to enable transactions among actual members.The prosecution also leveled fraud charges against them, claiming that the fabricated account was utilized to sell 11,550 bitcoins to 26,000 members, thereby generating KRW 149.1 billion.The Seoul Southern District Court, acting as the court of first instance, found them not guilty. The court reasoned that the evidence presented by the prosecution was insufficient to establish that the defendants actually deposited the assets in the account.Issues with the prosecution’s evidence gatheringThe Seoul High Court, serving as the appellate court, identified problems with the evidence provided by the prosecution, determining that part of it lacked credibility due to improper collection methods. Notably, the court observed that the prosecution had directed Dunamu employees to access their Amazon cloud server to download the account’s transaction history. However, since this remote server was not included in the search and seizure warrant, the court highlighted the illegitimacy of the evidence.The appellate court also pointed out another issue with the evidence: documents stored on the CFO’s USB drive. The prosecution did not follow the legitimate search process, which requires them to extract only data related to the allegations. Moreover, the prosecutors did not present a warrant when confiscating the laptop of the Data Value Team’s lead, further undermining the credibility of their evidence.The court further stated that even if the remaining evidence provided by the prosecution was considered viable, it was still insufficient to substantiate the prosecution’s accusations.The prosecution, disagreeing with the decision of the appeals court, had escalated the case to the Supreme Court. However, the highest court in the nation sided with the ruling of the appeals court, effectively upholding the decision made at the appellate level.

news
Policy & Regulation·

Sep 10, 2025

Ishiba’s exit raises questions over Japan’s crypto policy direction

Japanese Prime Minister Shigeru Ishiba announced his resignation on Sept. 7, citing completed trade talks with the United States and growing dissent within the ruling Liberal Democratic Party (LDP). While the political transition follows the party’s defeat in July’s upper house elections, Ishiba’s departure also creates uncertainty for Japan’s crypto and Web3 agenda, which he had championed. Just two weeks earlier, at the WebX2025 event, Ishiba pledged stronger state backing for Web3 initiatives, noting their potential for addressing Japan’s demographic challenges and driving long-term economic transformation. He highlighted token-based community governance pilots, integration of Web3 at the Osaka Expo, and a five-year startup growth plan centered on digital industries. His exit now raises questions about whether these priorities will carry the same weight under new leadership.Photo by taro ohtani on UnsplashLeadership contest brings policy uncertaintyPotential successors signal diverging approaches. As per a BeInCrypto report, former Economic Security Minister Sanae Takaichi, who topped an August Nikkei approval survey with 23% support, is regarded as favoring tighter oversight. Agriculture Minister Shinjiro Koizumi, in second place with 8%, has shown greater receptiveness toward digital assets. According to Bloomberg, Finance Minister Katsunobu Kato is also considered a contender. Earlier, he emphasized balancing investor protection with space for innovation, noting the rapid uptake of crypto among Japanese investors. The LDP is preparing for a leadership election on Oct. 4, with 295 lawmakers each casting one vote and an equal 295 votes allocated proportionally to the party’s 1.03 million members, for a total of 590 ballots. Until then, investors and industry players are watching for signals on whether Japan’s digital asset roadmap will remain a priority. Adoption advances beyond politicsBeyond politics, adoption is accelerating across Japan’s financial system. Japan Post Bank plans to tokenize deposits on a permissioned blockchain by 2026 using the DCJPY token developed by DeCurret DCP, a Mitsubishi UFJ–backed venture. With $1.29 trillion in deposits across 120 million accounts, the move could streamline settlement of tokenized securities. Corporate strategies are also shifting. Last month Tokyo-based game developer Gumi said it would acquire 2.5 billion yen ($17 million) worth of XRP between September 2025 and February 2026, following its earlier 1 billion yen ($6.8 million) Bitcoin purchase this year. The company described XRP as central to its expansion into international remittance and liquidity networks led by its largest shareholder, SBI Holdings. Japan’s crypto footprint abroad is growing as well. Coincheck, a leading exchange in Japan, is entering Europe through the acquisition of Aplo, a French-licensed digital asset brokerage. The deal follows Coincheck’s Nasdaq listing last year via its Netherlands-based holding company. 

news
Loading