Top

Upbit suffers $30M breach, overshadowing Dunamu’s major merger announcement

Markets·November 28, 2025, 2:27 AM

South Korea’s largest crypto exchange, Upbit, suffered a security breach on Nov. 27 that resulted in the theft of 44.5 billion won ($30.4 million) in digital assets, all taken from the exchange’s hot wallets. The stolen tokens were all Solana-based, and Upbit CEO Oh Kyoung-suk said in a statement that no users will incur losses, as the company will cover the full amount with its own reserves.

https://asset.coinness.com/en/news/070b84bbeb9f3292d29e545818df0769.webp
Photo by FlyD on Unsplash

Hot-wallet breach hits 24 tokens

The exchange said in a statement that the compromised tokens were transferred to an unknown external wallet at around 7:42 p.m. UTC on Nov. 26. In total, 24 cryptocurrencies were affected, all within the Solana ecosystem. The stolen assets ranged from infrastructure tokens such as Solana (SOL) to staking-related assets like Jito (JTO), along with the stablecoin USD Coin (USDC) and memecoins including Bonk (BONK), Moodeng (MOODENG), and Official Trump (TRUMP).

 

According to Oh, the breach was followed by an emergency security review of the affected networks and wallets. He added that all remaining assets were moved to cold storage to prevent further unauthorized transfers. Oh also said the exchange is working to trace the stolen assets and block on-chain movements wherever possible, noting that Solayer (LAYER) tokens worth 2.3 billion won ($1.6 million) have already been frozen. Upbit is also reaching out to relevant projects and institutions for assistance.

 

This marks Upbit’s second theft case. The first took place on Nov. 27, 2019, exactly six years ago to the day, according to News1.

 

Authorities focus on Lazarus’ involvement

Financial authorities are investigating the incident, and North Korea’s Lazarus Group is being treated as the leading suspect, the Maeil Business Newspaper reported.

 

Lazarus is also believed to have been behind the 58 billion won ($40 million) worth of Ethereum (ETH) stolen from Upbit in 2019. A government official told the paper that the latest breach did not appear to stem from a server intrusion but may have involved a stolen administrator account, allowing the attackers to impersonate internal staff and move assets—similar to the method used in the 2019 case.

 

Security analysts echoed that assessment. One investigator said the stolen funds moved through exchange wallets before being mixed, a pattern often linked to Lazarus. He added that mixers, which are prohibited in Financial Action Task Force (FATF)-member jurisdictions, make tracing difficult and that attackers typically route assets through countries outside that framework, further pointing to North Korea.

 

Following the incident, Upbit suspended deposits and withdrawals for all assets and said services will resume once security is fully verified. The halt has also affected trading dynamics on the exchange, with CryptoQuant CEO Ki Young Ju noting that retail investors are fueling altcoin spikes as arbitrage bots remain offline.

 

Dunamu, Naver set $6.8B growth plan

The security crisis struck at a particularly sensitive moment for Upbit’s operator, Dunamu, overshadowing what was intended to be a celebratory corporate milestone. On that same day, Dunamu, Naver, and Naver Financial held a joint press conference to outline their global expansion strategy. Dunamu brings its blockchain and crypto infrastructure, Naver contributes its position as Korea’s dominant search engine, and Naver Financial adds its payment platform serving 34 million users.

 

The event came after reports that Naver Financial and Dunamu had approved a merger plan through a comprehensive share swap, with the ratio set at 2.54 to 1. The three companies said they will combine their respective strengths to invest 10 trillion won ($6.8 billion) over the next five years in building an ecosystem centered on Web3 and artificial intelligence (AI).


During the press conference, Naver CEO Choi Soo-yeon said no decisions have been made on a Nasdaq listing for the newly combined Naver Financial–Dunamu entity or on whether it might eventually merge with Naver, according to TechM. She said dual listings remain a matter requiring national consensus. Choi also noted that while Naver Financial is a Naver subsidiary, Dunamu is the larger partner, and a later merger between the combined entity and Naver is unlikely.

More to Read
View All
Web3 & Enterprise·

Oct 25, 2023

Bitmain Planning Mining Equipment Support For Aleo Blockchain

Bitmain Planning Mining Equipment Support For Aleo BlockchainBitmain, the leading Beijing-headquartered crypto mining rig manufacturer, is set to bolster the proof-of-work (PoW) blockchain network of Aleo with its upcoming Antminer release.The firm announced its intentions via a social media post which was published on WeChat on Monday. The move follows Bitmain’s recent introductions of Filecoin and Kaspa mining machines and its latest series of Bitcoin miners.Photo by RDNE Stock project on PexelsEnhanced privacy through zk proofsBitmain plans to unveil a miner compatible with the forthcoming Aleo blockchain network which is currently in testnet mode. Aleo’s PoW blockchain promises to bring enhanced privacy through zero-knowledge (zk) proofs while retaining programmability. Zk proofs represent a cryptographic advancement insofar as they can verify data while it remains encrypted and undisclosed to the verifying party. The blockchain network adopts a statically typed programming language inspired by Rust, known as Leo.Aleo has been gaining significant attention in the crypto space, much like other venture capital-backed layer 1 blockchains, including Solana, Aptos, and NEAR, before their respective debuts. In April 2021, Aleo’s team successfully secured $28 million in a Series A funding round, with Andreessen Horowitz (a16z) leading the way.Aleo’s journey reached new heights in February 2022 when its Series B funding round raised a substantial $200 million, pushing the project into unicorn status. This funding round was jointly led by Softbank Vision Fund 2 and Kora Management LP, with participation from a16z, Tiger Global, Sea Capital, Slow Ventures, and Samsung Next.Latest in series of product launchesBitmain’s announcement is part of a series of product launches in recent months. In July, the company unveiled a mining rig designed for Filecoin (FIL). The following month marked the shipment of Bitmain’s Kaspa (KAS) mining machines. Shortly after the Kaspa deliveries, Bitmain revealed plans for an August release of a Monero (XMR) mining rig. Most recently, Bitmain introduced two next-generation Bitcoin (BTC) miners from the S21 series.The Chinese crypto mining equipment manufacturer has faced financial challenges in recent times. In April, it emerged that the company had been fined by the Chinese authorities for tax irregularities.Earlier this month, reports suggested that the company was experiencing liquidity issues. It failed to pay some of its employees although it later resolved the matter. Reports of staff payment difficulties surfaced two weeks ago. Arising out of that episode, the company subsequently fired three employees for posting information about salary payment issues on social media.Nevertheless, the firm managed to secure two contracts with US-based mining operations following those reports. In these contracts, Bitmain sold a combined 5.8 exahash per second (EH/s) of its new S21 Antminers to Iris Energy and Cleanspark. In September, Bitmain finalized a deal with troubled crypto miner Core Scientific that will see the firm supply the restructured company with 27,000 Bitcoin miners.The company has been blighted by internal conflicts going back a number of years between co-founders Jihan Wu and Zhan Ketuan. Subsequently Wu went on to found Singapore-headquartered crypto cloud mining platform Bitdeer.

news
Policy & Regulation·

Apr 12, 2023

Bitmain Fined by Chinese Authorities for Tax Irregularities

Beijing-based cryptocurrency mining firm Bitmain has reportedly violated tax regulations in China, with local authorities imposing major fines. According to the reports, Bitmain has failed to pay personal income taxes amounting to $2.4 million, which has led to a penalty of $3.7 million from the Beijing Municipal Office of the State Administration of Taxation. Leading mining equipment manufacturerBitmain Technologies is one of the biggest cryptocurrency mining equipment firms in the world, established in 2013. The company is renowned for its reputation as a manufacturer of crypto mining equipment and solutions. Reports suggest that Bitmain was compelled to end its operations in China in October 2021 as a direct result of the blanket ban on cryptocurrencies that was issued by the Chinese government in September 2021.However, despite these regulatory challenges and the bear market in the cryptocurrency industry in 2022, the company has reportedly continued to achieve success in its business. Bitmain’s latest Antminer product sold out within a minute in December, despite the declining profitability of cryptocurrency mining. On Tuesday, it emerged that North American crypto miner CleanSpark had acquired 45,000 Bitmain Antminers, doubling its mining capacity.The company’s founder, Jihan Wu, established a $250 million fund in September 2022 to help the mining industry during the difficult crypto winter. Following his departure from Bitmain in 2021, Wu established Bitdeer, a new cryptocurrency mining company that served as a spin-off of Bitmain. Crypto crackdownThe fine imposed on Bitmain highlights the continued scrutiny of the crypto industry in China. The country has taken steps to crack down on the crypto market, particularly going after the mining industry. China has banned crypto mining, though it still takes place via underground operations. One major headline in recent weeks related to the fact that a former Chinese Communist Party (CCP) secretary helped a crypto mining operation operate. One China court also ruled that cryptocurrency mining affects the climate negatively.Despite the crackdown, China is making headway with its digital yuan, a central bank digital currency (CBDC). The country continues to run pilots for the CBDC, each more extensive than the last. As China’s digital yuan gains momentum, it has been speculated that the country may use it as a tool to further restrict the use of decentralized cryptocurrencies.Companies operating in China will have to keep a close eye on their operations, especially since the country does not take a favorable stance towards crypto. Hong Kong hubHowever, Hong Kong is opening up to the crypto industry and is attempting to become a crypto hub. The Hong Kong government recently launched a regulatory framework for crypto exchanges, making it easier for crypto businesses to operate within the city. This move has attracted a significant number of crypto firms to relocate to Hong Kong from mainland China.Bitmain’s $3.7 million fine imposed for violating tax regulations in China is a clear sign that the scrutiny of the crypto industry in the country is still prevalent. Despite the challenges and uncertainties, the company has continued to achieve success in its business, and the industry’s regulatory landscape is continuously evolving. Companies in China will have to ensure compliance with all relevant regulations, while also exploring opportunities to operate in crypto-friendly jurisdictions like Hong Kong.

news
Web3 & Enterprise·

Dec 27, 2023

Kyber Network implements workforce reduction following exploit

In the aftermath of a substantial security breach in November that resulted in a confirmed loss of over $48 million, Kyber Network, the multi-chain decentralized exchange (DEX) aggregator, has taken decisive steps to restructure its operations.Photo by kate.sade on UnsplashWorking towards recoveryCEO and co-founder Victor Tran posted a lengthy message on the X social media platform on Christmas Eve to announce a 50% reduction in the firm’s workforce. The move marks a pivotal moment in the company’s efforts to recover and rebuild. As part of its strategy to ensure sustainability, Kyber temporarily suspended its liquidity protocol initiatives and KyberAI. Despite these challenging measures, the core aggregator and limit order functions remain fully operational. Tran emphasized the company’s commitment to persist and evolve, highlighting its determination to navigate through recent adversities. Despite these challenging measures, the core aggregator and limit order functions remain fully operational. Tran emphasized the company’s commitment to persist and evolve, highlighting its determination to navigate through recent adversities. Zap API additionIn an effort to enhance its services, Kyber Network disclosed plans to introduce the Zap API. This new offering aims to provide decentralized applications, crypto wallets and other DeFi projects with a seamless means to connect their users to liquidity protocols. Tran also revealed that in an effort to support its workforce during the transition, the firm has established a “voluntary database” to assist departing employees in finding new career opportunities. This initiative seeks to connect these individuals with peer projects in the industry. Exploit fall-outKyber Network took to social media on Nov. 22 to advise its KyberSwap Elastic user base of a security incident. With that notification, it advised users to withdraw their funds immediately. Over the next few days, it became clear that $48 million had been exploited on the platform by a hacker. In the immediate aftermath of the incident, the hacker posted a message on the blockchain, stating: “Negotiations will start in a few hours when I am fully rested.” He/she progressed to issuing unusual demands, including gaining complete operational control of the company and temporary ownership of the KyberDAO governance mechanism. The nature of these demands sets this particular exploit apart from others. The Kyber team, however, chose to reject these demands. It chose to respond with a blockchain message of its own, outlining that it was cooperating with law enforcement in an effort to track the hacker. The company, which operates from offices in Hanoi, Ho Chi Minh City and Singapore, also offered the hacker a carrot of a 10% bounty if the hacker agreed to return 90% of users’ funds. Instead, the firm pledged to compensate affected users through the KyberSwap Elastic Exploit Treasury Grant Program. On Dec. 20, the firm provided further details on that grant program, outlining how affected users would be refunded. Furthermore, Kyber Network is actively collaborating with authorities to identify the hacker and recover the stolen funds.Earlier this month, blockchain security firm CertiK issued an alert on social media, outlining that the hacker had moved BNB tokens to the value of $338,000 into decentralized crypto tumbler Tornado Cash.

news
Loading