Top

Upbit suffers $30M breach, overshadowing Dunamu’s major merger announcement

Markets·November 28, 2025, 2:27 AM

South Korea’s largest crypto exchange, Upbit, suffered a security breach on Nov. 27 that resulted in the theft of 44.5 billion won ($30.4 million) in digital assets, all taken from the exchange’s hot wallets. The stolen tokens were all Solana-based, and Upbit CEO Oh Kyoung-suk said in a statement that no users will incur losses, as the company will cover the full amount with its own reserves.

https://asset.coinness.com/en/news/070b84bbeb9f3292d29e545818df0769.webp
Photo by FlyD on Unsplash

Hot-wallet breach hits 24 tokens

The exchange said in a statement that the compromised tokens were transferred to an unknown external wallet at around 7:42 p.m. UTC on Nov. 26. In total, 24 cryptocurrencies were affected, all within the Solana ecosystem. The stolen assets ranged from infrastructure tokens such as Solana (SOL) to staking-related assets like Jito (JTO), along with the stablecoin USD Coin (USDC) and memecoins including Bonk (BONK), Moodeng (MOODENG), and Official Trump (TRUMP).

 

According to Oh, the breach was followed by an emergency security review of the affected networks and wallets. He added that all remaining assets were moved to cold storage to prevent further unauthorized transfers. Oh also said the exchange is working to trace the stolen assets and block on-chain movements wherever possible, noting that Solayer (LAYER) tokens worth 2.3 billion won ($1.6 million) have already been frozen. Upbit is also reaching out to relevant projects and institutions for assistance.

 

This marks Upbit’s second theft case. The first took place on Nov. 27, 2019, exactly six years ago to the day, according to News1.

 

Authorities focus on Lazarus’ involvement

Financial authorities are investigating the incident, and North Korea’s Lazarus Group is being treated as the leading suspect, the Maeil Business Newspaper reported.

 

Lazarus is also believed to have been behind the 58 billion won ($40 million) worth of Ethereum (ETH) stolen from Upbit in 2019. A government official told the paper that the latest breach did not appear to stem from a server intrusion but may have involved a stolen administrator account, allowing the attackers to impersonate internal staff and move assets—similar to the method used in the 2019 case.

 

Security analysts echoed that assessment. One investigator said the stolen funds moved through exchange wallets before being mixed, a pattern often linked to Lazarus. He added that mixers, which are prohibited in Financial Action Task Force (FATF)-member jurisdictions, make tracing difficult and that attackers typically route assets through countries outside that framework, further pointing to North Korea.

 

Following the incident, Upbit suspended deposits and withdrawals for all assets and said services will resume once security is fully verified. The halt has also affected trading dynamics on the exchange, with CryptoQuant CEO Ki Young Ju noting that retail investors are fueling altcoin spikes as arbitrage bots remain offline.

 

Dunamu, Naver set $6.8B growth plan

The security crisis struck at a particularly sensitive moment for Upbit’s operator, Dunamu, overshadowing what was intended to be a celebratory corporate milestone. On that same day, Dunamu, Naver, and Naver Financial held a joint press conference to outline their global expansion strategy. Dunamu brings its blockchain and crypto infrastructure, Naver contributes its position as Korea’s dominant search engine, and Naver Financial adds its payment platform serving 34 million users.

 

The event came after reports that Naver Financial and Dunamu had approved a merger plan through a comprehensive share swap, with the ratio set at 2.54 to 1. The three companies said they will combine their respective strengths to invest 10 trillion won ($6.8 billion) over the next five years in building an ecosystem centered on Web3 and artificial intelligence (AI).


During the press conference, Naver CEO Choi Soo-yeon said no decisions have been made on a Nasdaq listing for the newly combined Naver Financial–Dunamu entity or on whether it might eventually merge with Naver, according to TechM. She said dual listings remain a matter requiring national consensus. Choi also noted that while Naver Financial is a Naver subsidiary, Dunamu is the larger partner, and a later merger between the combined entity and Naver is unlikely.

More to Read
View All
Policy & Regulation·

Dec 29, 2025

Japan plans separate tax treatment for crypto ETFs and derivatives

Japan’s Financial Services Agency (FSA) is advancing proposals to authorize exchange-traded funds (ETFs) backed by specific cryptocurrencies, a move that fleshes out previously reported plans to apply a flat 20% separate tax to crypto gains. According to agency materials released on Dec. 26 and reported by CoinPost, the regulator has now clarified that crypto-linked ETFs and derivatives will be integrated into this new tax framework.Photo by Jakub Żerdzicki on UnsplashThe materials, part of the tax reform framework for the fiscal year 2026, indicate that the regulator intends to align the tax treatment of crypto-linked ETFs with that of stocks and foreign exchange trading. Under the current system, cryptocurrency gains in Japan are classified as miscellaneous income, subjecting investors to progressive tax rates that can reach approximately 55% when local levies are included. The proposed reforms aim to integrate crypto assets into the Financial Instruments and Exchange Act (FIEA), a legislative package slated for debate during the 2026 Diet session. Derivatives also subject to separate taxBeyond ETFs, the regulator plans to adjust the taxation of derivative products based on certain crypto assets. While these derivatives would remain classified as miscellaneous income—similar to conventional futures—the method of taxation would shift from comprehensive taxation to a separate self-assessment model. Despite the outlined tax reductions, market observers anticipate that full implementation may be delayed until 2028 due to the time required to amend the relevant laws and government ordinances. FSA restructures to better oversee cryptoIn parallel with regulatory updates, the FSA is restructuring its internal operations to better address digital finance. Nikkei reported that the agency has decided to elevate its Crypto-Assets and Blockchain Innovation Office to the status of a division beginning in the administrative fiscal year starting July 2026. This restructuring follows an August proposal in which the FSA cited the need to bolster its capacity to handle financial services transformed by financial technology, crypto trading, and generative artificial intelligence (AI). The agency noted that it faces accumulating challenges, including fraud prevention and the government's broader goal of positioning Japan as a leading asset management nation. Additionally, the establishment of a new Asset Management and Insurance Supervision Bureau is expected as part of the reorganization. The regulatory shifts coincide with broader efforts to integrate blockchain technology into Japan's financial infrastructure. A separate Nikkei report last week stated that policymakers have agreed to prepare for the issuance of local government bonds as blockchain-based security tokens. The government plans to submit the necessary legislation during the next ordinary Diet session, aiming to streamline settlement processes and enable real-time monitoring of investor data. Corporate crypto strategies persist despite concernsIn the private sector, Tokyo Stock Exchange-listed Metaplanet is proceeding with a corporate strategy focused on Bitcoin accumulation. Dylan LeClair, the company's Director of Bitcoin Strategy, said on X that shareholders at an extraordinary meeting approved proposals to raise capital for additional Bitcoin purchases, including the issuance of Class B preferred shares to overseas institutional investors. Earlier this year, Metaplanet shareholders authorized a long-term plan to acquire more than 210,000 Bitcoin by 2027, representing roughly 1% of the total supply. However, analysts warn that corporate models based primarily on asset accumulation face structural risks. According to Cointelegraph, industry figures such as MoreMarkets CEO Altan Tutar and Solv Protocol co-founder Ryan Chow have cautioned that companies relying solely on digital asset holdings may struggle to maintain valuations without developing operational businesses that generate consistent returns. 

news
Web3 & Enterprise·

Sep 12, 2023

Wemade Leverages Blockchain to Host Professional Women’s Golf Tournament in Busan

Wemade Leverages Blockchain to Host Professional Women’s Golf Tournament in BusanWemade, a blockchain game company headquartered in South Korea, is gearing up to host a professional women’s golf tournament at the Haeundae Beach Golf and Resort in Busan, the nation’s southern port city. The tournament is scheduled to take place from November 18 to 19.Photo by mk. s on Unsplash1 million WEMIX prize poolThe event, titled the WEMIX Championship 2023, will showcase the top 20 KLPGA Tour golfers in the WEMIX point ranking, along with four invited players. They will vie for a prize pool of 1 million WEMIX, which, as per CoinMarketCap, is trading at $0.5585 at the time of publication. The tournament will be live-streamed through the SBS Golf television channel.The WEMIX point ranking, established in collaboration with SBS Golf, is determined by assessing the performance and results achieved by members of the regular Korea Ladies Professional Golf Association (KLPGA) Tour.NFT tickets and souvenirsDuring this event, Wemade’s DAO and NFT platform, NILE, will showcase non-fungible tokens (NFTs) that represent admission tickets and official souvenirs. These NFTs will be available for purchase on the NILE marketplace starting in October, giving golf enthusiasts the opportunity to acquire them.By integrating blockchain technology into the golf tournament, Wemade is expected to deliver a fresh and innovative experience for both organizers and spectators alike.Furthermore, Wemade aims to increase its investment in the WEMIX Championship, with the goal of enhancing the tournament’s reputation as a prestigious season-ending event.

news
Web3 & Enterprise·

Jun 15, 2023

FPG Halts Withdrawals Following Hack

FPG Halts Withdrawals Following HackFloating Point Group (FPG), a prominent crypto prime brokerage platform, has temporarily halted trading, deposits, and withdrawals following a cyber security incident that occurred on Sunday.Photo by Thom Milkovic on UnsplashIncident responseFPG, headquartered in Singapore while maintaining a base in Hoboken, New Jersey in the United States, manages over $50 billion in assets. The firm took immediate action upon discovering the incident by engaging third-party forensics experts and law enforcement agencies.The company acknowledged the problem publicly via a tweet thread on Twitter on Wednesday. FPG stated that the company has locked all third-party accounts and secured its wallets while it investigates the extent and details of the breach. Although the full extent of the loss is still under investigation, the current estimate stands at approximately $15 million to $20 million in lost cryptocurrencies.Investigative cooperationIn response to the incident, FPG is collaborating with the FBI, the Department of Homeland Security, regulatory bodies, and Chainalysis to comprehend the nature of the attack and initiate asset recovery measures. As the investigation involving those entities is ongoing, specific details are not being disclosed at this stage, but FPG has pledged to provide updates as new information becomes available.The cyber security incident comes six months after FPG obtained a SOC 2 certification, which verifies the implementation of robust security, privacy, and control measures by service organizations to ensure the reliable handling of sensitive data and systems.Originally founded in 2018 at the Massachusetts Institute of Technology (MIT) in the US, FPG functions as both a crypto prime brokerage platform and an agency trading desk for asset managers, offering access to liquidity across various markets. In December, FPG announced that its blockchain foundation customers accounted for 5% of the total treasury management market.Backed by prominent investors such as Coinbase Ventures, Anthony Scaramucci of SkyBridge Capital, and Naval Ravikant, the founder of AngelList, FPG has raised a total of $12 million in funding thus far.In August of the previous year, FPG successfully registered as a virtual asset service provider (VASP) in the Cayman Islands. This registration ensured the secure custody of customer assets and safeguarded them from the company’s creditors in the unlikely event of bankruptcy.Broader crypto issuesIt has not been a good couple of weeks for the crypto sector relative to hacks and platform withdrawal pauses. Within the past twenty four hours, two Asia-based crypto lending platforms, Haru Invest and Delio, have suspended withdrawals. In those cases, the issue is suspected to relate to platform contagion and solvency issues.Earlier this month, the Atomic Wallet platform was hacked despite the understanding that the project offered self-custodial wallets. Originally, the loss was estimated at $35 million, but more recent reports are now estimating that figure to be in excess of $100 million.As FPG continues its efforts to mitigate the aftermath of the cyber attack, industry participants eagerly await further updates and measures undertaken by the company to recover from this incident and restore trust among its clients.

news
Loading