Top

Upbit suffers $30M breach, overshadowing Dunamu’s major merger announcement

Markets·November 28, 2025, 2:27 AM

South Korea’s largest crypto exchange, Upbit, suffered a security breach on Nov. 27 that resulted in the theft of 44.5 billion won ($30.4 million) in digital assets, all taken from the exchange’s hot wallets. The stolen tokens were all Solana-based, and Upbit CEO Oh Kyoung-suk said in a statement that no users will incur losses, as the company will cover the full amount with its own reserves.

https://asset.coinness.com/en/news/070b84bbeb9f3292d29e545818df0769.webp
Photo by FlyD on Unsplash

Hot-wallet breach hits 24 tokens

The exchange said in a statement that the compromised tokens were transferred to an unknown external wallet at around 7:42 p.m. UTC on Nov. 26. In total, 24 cryptocurrencies were affected, all within the Solana ecosystem. The stolen assets ranged from infrastructure tokens such as Solana (SOL) to staking-related assets like Jito (JTO), along with the stablecoin USD Coin (USDC) and memecoins including Bonk (BONK), Moodeng (MOODENG), and Official Trump (TRUMP).

 

According to Oh, the breach was followed by an emergency security review of the affected networks and wallets. He added that all remaining assets were moved to cold storage to prevent further unauthorized transfers. Oh also said the exchange is working to trace the stolen assets and block on-chain movements wherever possible, noting that Solayer (LAYER) tokens worth 2.3 billion won ($1.6 million) have already been frozen. Upbit is also reaching out to relevant projects and institutions for assistance.

 

This marks Upbit’s second theft case. The first took place on Nov. 27, 2019, exactly six years ago to the day, according to News1.

 

Authorities focus on Lazarus’ involvement

Financial authorities are investigating the incident, and North Korea’s Lazarus Group is being treated as the leading suspect, the Maeil Business Newspaper reported.

 

Lazarus is also believed to have been behind the 58 billion won ($40 million) worth of Ethereum (ETH) stolen from Upbit in 2019. A government official told the paper that the latest breach did not appear to stem from a server intrusion but may have involved a stolen administrator account, allowing the attackers to impersonate internal staff and move assets—similar to the method used in the 2019 case.

 

Security analysts echoed that assessment. One investigator said the stolen funds moved through exchange wallets before being mixed, a pattern often linked to Lazarus. He added that mixers, which are prohibited in Financial Action Task Force (FATF)-member jurisdictions, make tracing difficult and that attackers typically route assets through countries outside that framework, further pointing to North Korea.

 

Following the incident, Upbit suspended deposits and withdrawals for all assets and said services will resume once security is fully verified. The halt has also affected trading dynamics on the exchange, with CryptoQuant CEO Ki Young Ju noting that retail investors are fueling altcoin spikes as arbitrage bots remain offline.

 

Dunamu, Naver set $6.8B growth plan

The security crisis struck at a particularly sensitive moment for Upbit’s operator, Dunamu, overshadowing what was intended to be a celebratory corporate milestone. On that same day, Dunamu, Naver, and Naver Financial held a joint press conference to outline their global expansion strategy. Dunamu brings its blockchain and crypto infrastructure, Naver contributes its position as Korea’s dominant search engine, and Naver Financial adds its payment platform serving 34 million users.

 

The event came after reports that Naver Financial and Dunamu had approved a merger plan through a comprehensive share swap, with the ratio set at 1 to 2.54. The three companies said they will combine their respective strengths to invest 10 trillion won ($6.8 billion) over the next five years in building an ecosystem centered on Web3 and artificial intelligence (AI).


During the press conference, Naver CEO Choi Soo-yeon said no decisions have been made on a Nasdaq listing for the newly combined Naver Financial–Dunamu entity or on whether it might eventually merge with Naver, according to TechM. She said dual listings remain a matter requiring national consensus. Choi also noted that while Naver Financial is a Naver subsidiary, Dunamu is the larger partner, and a later merger between the combined entity and Naver is unlikely.

More to Read
View All
Web3 & Enterprise·

Mar 05, 2025

Silver lining for Bybit with UAE trading license approval

After being targeted in a $1.4 billion hack, the global crypto exchange platform Bybit was awarded in-principle approval to establish itself as a Virtual Asset Platform Operator (VAPO) within the United Arab Emirates (UAE). While Bybit announced the milestone via a press release published on Feb. 27, the approval had been awarded on Feb. 18, three days before the platform was hacked.Photo by Saj Shafique on UnsplashRegulatory challengesIn addition to the recent exploit, the crypto exchange platform had been having difficulties on the regulatory front in recent months, and from that perspective, this licensing award is a welcome development. Last December, the Malaysian Securities Commission reprimanded the platform and its CEO, Ben Zhou, for carrying out digital asset trading activities in Malaysia without having obtained the necessary licensing. Consequently, the firm left the Malaysian market, promising to return once it had obtained the required licenses. For similar reasons, Bybit left the Indian market in January, citing a need to “operate in full compliance” with local regulations. The company said that it was working with the regulator to finalize its registration as a Virtual Asset Service Provider (VASP) in India. The platform also experienced difficulties in complying with the recently introduced Markets in Crypto Assets (MiCA) regulation in Europe. However, it has been working with regulators in Austria in an effort to acquire MiCA licensing. Consequently, the French regulator, Autorité des Marchés Financiers, removed the firm from its blacklist. Earlier this month, Japan’s Financial Services Agency (FSA) ordered Apple and Google to remove the apps of a number of unregistered crypto platforms, including Bybit, from the Japanese versions of their app stores.  Commenting on this recent achievement in the UAE, Ben Zhou stated: “This approval marks a crucial step in our journey to providing secure and transparent crypto trading solutions. Bybit remains dedicated to working hand-in-hand with regulators to foster a compliant and innovative digital asset ecosystem to both retail and institutional investors in the UAE.” Hack falloutIt’s unclear to what extent the recent hack, which is understood to be one of the largest thefts of any kind, may be diverting resources and focus away from the efforts the company was making to address regulatory issues globally. However, it’s reasonable to assume that recent events make for a challenging time for the company. On Feb. 26, the Federal Bureau of Investigation (FBI) in the United States said that North Korea was responsible for the hack. The agency warned exchanges to freeze transactions linked to the stolen funds. The FBI outlined that “TraderTraitor” actors have been converting the funds to Bitcoin and other digital assets in an effort to launder the funds and eventually extract the funds in fiat currency. North Korea’s Lazarus hacking group has gained notoriety for its successes in hacking crypto platforms and the sophisticated nature of the attacks mounted in the process. The group is suspected of having hacked the Indian crypto platform WazirX last year, which resulted in the theft of $235 million in digital assets.

news
Web3 & Enterprise·

Nov 30, 2023

IOTA accelerates Middle East expansion with $100M foundation launch

IOTA accelerates Middle East expansion with $100M foundation launchIn a move aimed at catalyzing the adoption of its distributed ledger technology (DLT) in the Middle East, the Berlin-headquartered IOTA Foundation, the developmental force behind the IOTA-directed acyclic graph-based ledger network, unveiled a $100 million foundation in Abu Dhabi on Wednesday.Photo by Imtiyaz Ali on UnsplashTokenizing real-world assetsThe IOTA Foundation announced details of the initiative, known as the IOTA Ecosystem DLT Foundation, via a blog post published on its website on Wednesday. The new foundation is designed to facilitate the transformation of tangible assets into digital entities, marking a significant stride in the convergence of real-world assets with the digital realm, according to IOTA Co-founder and Chairman Dominik Schiener.Taking to the X platform, Schiener wrote:”We will double down on our efforts to bring the real world to Web3. We will pave the way to tokenize RWA [Real World Assets] assets on #IOTA and work with the governments in the UAE, across the Middle East and Africa to digitize their trade infrastructure and tokenize assets. We will make Blockchain real, with real use cases, real adoption, real yield and real assets.”IOTA is not a blockchain, but a related distributed ledger technology. DLT has garnered attention for its diverse applications over the past decade. IOTA’s digital tokens will serve as the financial backbone for this substantial investment, signaling a strategic move amidst recent setbacks in the cryptocurrency sector.Regulatory first in Abu DhabiThe IOTA Ecosystem DLT Foundation stands out as the first blockchain-focused foundation sanctioned by the regulatory authorities of the Abu Dhabi Global Market (ADGM), a key financial hub within the United Arab Emirates (UAE). The ADGM solidified its blockchain regulations in early November, creating a conducive environment for innovative blockchain-focused entities. The regulatory framework was crafted to offer a comprehensive structure specifically for DLT foundations and decentralized autonomous organizations (DAOs).Schiener expanded further on plans for the DLT Foundation:”With a new headquarter in the UAE, we are positioning IOTA from being an Enterprise Blockchain in Europe, to becoming one of the largest, global Crypto ecosystems. We will fully support Web3 and DeFi use cases on IOTA with the #EVM launch in Q1.”Endowed with over $100 million in IOTA tokens, the foundation’s funds will be gradually vested over the next four years.The financial infusion is earmarked for the development and expansion of the IOTA network. Additionally, IOTA will embark on asset “tokenization,” a process involving the representation of ownership rights for land or buildings as digital tokens stored on a blockchain. These tokens, akin to digital certificates of ownership, extend to virtually any valuable object.IOTA launched in 2015, and within its first two years, it rose to be a top-ten crypto project on the basis of market capitalization. Over the course of the last six years, the project has struggled to make the network less centralized. There have also been internal conflicts, which resulted in a number of the project’s co-founders stepping away from the project. With this latest development, Schiener suggested that IOTA could work its way back to being a top-ten project once again.

news
Web3 & Enterprise·

Jul 25, 2023

Top Korean Crypto Exchanges Witness Surge in Listings and Delistings During H1

Top Korean Crypto Exchanges Witness Surge in Listings and Delistings During H1In the first half of this year, South Korea’s top five cryptocurrency exchanges experienced notable growth in the number of newly added cryptocurrencies to their platforms. However, they also observed a significant surge in the number of cryptocurrencies being delisted.Photo by Shubham Dhage on UnsplashDelisting and listingAccording to a report by local news outlet Etoday, the nation’s five leading exchanges Upbit, Bithumb, Coinone, Korbit, and Gopax ceased trading for a total of 51 cryptocurrencies during the first six months of this year. This marked an 88% increase compared to the 27 cryptocurrencies delisted in the previous six-month period. During the first half of last year, the number of delisted tokens was 48.Among the five exchanges, Coinone took the lead by delisting the highest number of cryptocurrencies, totaling 24. Bithumb followed with 14 delisted tokens, Gopax with six, Upbit with five, and Korbit with two. Notably, Coinone continued its delisting spree this month, removing an additional five cryptocurrencies from its platform. Most cryptos were delisted because their projects and services were not operating normally.The significant number of delisted tokens at Coinone appears to be linked to the involvement of its former employees in the unlawful listing of certain tokens. These individuals reportedly received bribes in exchange for listing a total of 46 cryptocurrencies on the trading platform. Among these tokens were PICA and PURE, which are no longer traded on the exchange.Only five cryptocurrencies were delisted according to the decision made by the Digital Asset eXchange Alliance (DAXA), a self-regulatory group consisting of the aforementioned five crypto exchanges. The delisted tokens were REP, BASIC, OMG, SRM, and PCI. This indicates that most of the affected cryptocurrencies were exclusively traded on one of the DAXA member exchanges, indicating that DAXA’s listing and delisting guidelines were largely ineffective.Meanwhile, there has been a notable surge in the number of newly added cryptocurrencies. Bithumb, for instance, took the lead by listing an impressive 63 new tokens, nearly three times the number listed by Upbit (22). In the same vein, Coinone added 14 tokens, while Korbit and Gopax followed with six and three new listings, respectively.Profit squeezeLast year, crypto trading platforms adopted a conservative approach when it came to listing and delisting procedures, prioritizing investor protection. However, their stance shifted as the global crypto market encountered a significant decline in trading volume amid crypto winter. This decrease in trading activity subsequently led to reduced operating profits, compelling the platforms to list more cryptocurrencies.With the exception of Upbit, which maintains a dominant market share in the nation, the outlook on crypto exchanges appears more or less grim. In particular, Coinone, Korbit, and Gopax are in the red. Bithumb, while still in profit, saw its operating profit last year falling 80% year-over-year to 163.5 billion KRW ($127.9 million). This trend continued this year, with Bithumb’s operating profit In the first quarter of this year recording 16.2 billion KRW, an 80% decrease compared to the same period last year.In light of this development, an industry insider, who wished to stay anonymous, told Etoday that while the market’s total trading volume is witnessing a considerable decline, Upbit’s dominance is still growing. This individual also noted that the decrease in trading volume and the resulting deficit are exerting pressure on exchanges to expand their cryptocurrency listings.

news
Loading