Top

Upbit suffers $30M breach, overshadowing Dunamu’s major merger announcement

Markets·November 28, 2025, 2:27 AM

South Korea’s largest crypto exchange, Upbit, suffered a security breach on Nov. 27 that resulted in the theft of 44.5 billion won ($30.4 million) in digital assets, all taken from the exchange’s hot wallets. The stolen tokens were all Solana-based, and Upbit CEO Oh Kyoung-suk said in a statement that no users will incur losses, as the company will cover the full amount with its own reserves.

https://asset.coinness.com/en/news/070b84bbeb9f3292d29e545818df0769.webp
Photo by FlyD on Unsplash

Hot-wallet breach hits 24 tokens

The exchange said in a statement that the compromised tokens were transferred to an unknown external wallet at around 7:42 p.m. UTC on Nov. 26. In total, 24 cryptocurrencies were affected, all within the Solana ecosystem. The stolen assets ranged from infrastructure tokens such as Solana (SOL) to staking-related assets like Jito (JTO), along with the stablecoin USD Coin (USDC) and memecoins including Bonk (BONK), Moodeng (MOODENG), and Official Trump (TRUMP).

 

According to Oh, the breach was followed by an emergency security review of the affected networks and wallets. He added that all remaining assets were moved to cold storage to prevent further unauthorized transfers. Oh also said the exchange is working to trace the stolen assets and block on-chain movements wherever possible, noting that Solayer (LAYER) tokens worth 2.3 billion won ($1.6 million) have already been frozen. Upbit is also reaching out to relevant projects and institutions for assistance.

 

This marks Upbit’s second theft case. The first took place on Nov. 27, 2019, exactly six years ago to the day, according to News1.

 

Authorities focus on Lazarus’ involvement

Financial authorities are investigating the incident, and North Korea’s Lazarus Group is being treated as the leading suspect, the Maeil Business Newspaper reported.

 

Lazarus is also believed to have been behind the 58 billion won ($40 million) worth of Ethereum (ETH) stolen from Upbit in 2019. A government official told the paper that the latest breach did not appear to stem from a server intrusion but may have involved a stolen administrator account, allowing the attackers to impersonate internal staff and move assets—similar to the method used in the 2019 case.

 

Security analysts echoed that assessment. One investigator said the stolen funds moved through exchange wallets before being mixed, a pattern often linked to Lazarus. He added that mixers, which are prohibited in Financial Action Task Force (FATF)-member jurisdictions, make tracing difficult and that attackers typically route assets through countries outside that framework, further pointing to North Korea.

 

Following the incident, Upbit suspended deposits and withdrawals for all assets and said services will resume once security is fully verified. The halt has also affected trading dynamics on the exchange, with CryptoQuant CEO Ki Young Ju noting that retail investors are fueling altcoin spikes as arbitrage bots remain offline.

 

Dunamu, Naver set $6.8B growth plan

The security crisis struck at a particularly sensitive moment for Upbit’s operator, Dunamu, overshadowing what was intended to be a celebratory corporate milestone. On that same day, Dunamu, Naver, and Naver Financial held a joint press conference to outline their global expansion strategy. Dunamu brings its blockchain and crypto infrastructure, Naver contributes its position as Korea’s dominant search engine, and Naver Financial adds its payment platform serving 34 million users.

 

The event came after reports that Naver Financial and Dunamu had approved a merger plan through a comprehensive share swap, with the ratio set at 1 to 2.54. The three companies said they will combine their respective strengths to invest 10 trillion won ($6.8 billion) over the next five years in building an ecosystem centered on Web3 and artificial intelligence (AI).


During the press conference, Naver CEO Choi Soo-yeon said no decisions have been made on a Nasdaq listing for the newly combined Naver Financial–Dunamu entity or on whether it might eventually merge with Naver, according to TechM. She said dual listings remain a matter requiring national consensus. Choi also noted that while Naver Financial is a Naver subsidiary, Dunamu is the larger partner, and a later merger between the combined entity and Naver is unlikely.

More to Read
View All
Web3 & Enterprise·

Dec 16, 2023

Coti plans transition to Ethereum layer-2 network in 2024

Coti plans transition to Ethereum layer-2 network in 2024Israeli blockchain developer Coti plans to introduce a scalable, privacy-focused Ethereum layer-2 protocol in 2024. This strategic move aims to extend Coti’s privacy-centric features to a wider audience within the Ethereum ecosystem.Photo by Zoltan Tasi on UnsplashIncorporating ‘garbled circuits’Taking to the X social media platform on Wednesday, Coti unveiled its plan to transition from a standalone protocol to an Ethereum layer-2. The centerpiece of the project, which Coti has termed “Coti v2: a privacy-centric Ethereum L2,” is a cryptographic method known as “garbled circuits.”Garbled circuits are a cryptographic primitive that enables two or more parties to evaluate an arbitrary Boolean circuit securely, without revealing any information beyond the output, all while using a constant number of communication rounds. This innovative approach enables the processing of transactions without exposing sensitive information and data, aligning with the platform’s commitment to privacy.Having originated in the 1980s, garbling protocols have evolved into a crucial element of privacy-preserving technologies, excelling in scenarios where confidential data needs to be part of a computation without revealing the information itself.Focusing on privacyCoti CEO Shahaf Bar-Geffen emphasized the significance of this privacy-oriented protocol, stating:“Sensitive data transmitted as public information on a blockchain is a bug, not a feature.”Bar-Geffen highlighted the protocol’s ability to prevent sensitive data from being exposed to competitors, partners and clients engaged in transactions on Coti’s chain. The CEO elaborated on how garbling protocols differentiate Coti v2 by facilitating transactions and smart contract executions where details remain private between involved parties.The Coti CEO emphasized the critical role of such privacy features in decentralized finance applications, where transaction confidentiality is as essential as transaction integrity. Coti claims that other platforms focusing solely on anonymity for privacy may face regulatory challenges and might not provide a compliant foundation for the broader ecosystem.Targeting specific use casesCoti envisions its protocol catering specifically to use cases demanding advanced privacy provisions in finance and healthcare. Currently designed for enterprises, Coti’s existing protocol enables the management of blockchain-based products such as custom-branded tokens, wallets, website integrations and fiat on-and-off ramps.In a blog post on Medium, the blockchain startup outlined that in addition to privacy, v2 will enable smart contracts, EVM compatibility and Solidity programming, alongside the features currently offered by v1. Notwithstanding these new features on the v2 product, the company confirmed to The Block that in respect of Coti’s original Cardano-based product, “Coti’s work with Cardano continues. We have a project built there called Djed, and that will continue to remain on Cardano.” Djed is an ADA-backed stablecoin pegged to the U.S. dollar.The anticipated release of Coti v2’s developer net in the second quarter of 2024 signals a move towards realizing the potential in advancing Ethereum’s privacy standards. As a layer-1 protocol, Coti presently contributes to Web3 applications by providing digital infrastructure, including tools for wallets, tokens and payment modules, with a total value locked of $31 million.The upcoming integration as a privacy-centric layer-2 positions Coti as a key player in enhancing Ethereum’s capabilities and fostering a more secure and confidential blockchain experience.

news
Web3 & Enterprise·

May 18, 2023

Korean Crypto Exchange Operator Airdrops NFTs to Raise Biodiversity Awareness

Korean Crypto Exchange Operator Airdrops NFTs to Raise Biodiversity AwarenessDunamu, the operator of Upbit, one of South Korea’s leading cryptocurrency exchanges, made an announcement on Thursday regarding its initiative to raise awareness about biodiversity threatened by climate change. In collaboration with four organizations affiliated with the Ministry of Environment, Dunamu plans to transform Climate-Sensitive Biological Indicator Species (CBIS) into non-fungible tokens (NFTs), as reported by news media Daily Hankook.Photo by Alin Andersen on UnsplashAffected biological speciesCBIS encompasses biological species that have experienced significant changes in their seasonal activities, distribution areas, and population sizes due to climate change. These species require ongoing research and management by the government. The National Institute of Biological Resources (NIBR) of the Ministry of Environment compiled a list of 100 such species in July 2010. This list was created to facilitate the efficient monitoring of climate change’s impact on the distribution and vulnerability of biological species on the Korean Peninsula.The initiative is part of the Resource Circulation Climate Action Campaign organized by Dunamu with four environment agencies, namely the NIBR, the Nakdonggang National Institute of Biological Resources (NNIBR), the Honam National Institute of Biological Resources (HNIBR), and the National Institute of Ecology (NIE). Its key objective is to protect the habitats of plants and animals while raising awareness about biodiversity conservation.Species vanishing every 15 minutesWith climate change causing the extinction of one species every 15 minutes, the project aims to raise awareness about this distressing trend. In pursuit of this goal, 15 NFT editions will be distributed through four separate events over the course of a year, commencing on May 19. The participating artists include Jjawook, an artist with developmental disabilities; Jin Kwan-woo, an artist renowned for depicting endangered species using the Korean alphabet Hangul; and members of the Botanical Artists Society of Korea.NFT release planThe initial set of NFTs to be airdropped includes three species: the warbling white-eye, the common camellia, and the house holly-fern. These species have historically inhabited coastal regions of islands. However, as a result of climate change, their distribution and habitat have been shifting towards inland or northern areas.To obtain CBIS NFTs, individuals can visit Dunamu’s metaverse platform 2ndblock. Once there, they will have the opportunity to engage in a resource collection mission. Upon successfully completing the mission, users will receive an NFT gift code. To claim their NFTs, they need to register the provided NFT gift code on the Upbit NFT marketplace.Dunamu CEO Lee Sirgoo expressed his hope that the project would have a positive impact on raising awareness about biodiversity conservation on the Korean Peninsula, which is under threat from climate change. He stated that Dunamu intends to continue utilizing its technology and expertise in diverse ways to contribute to a sustainable future and environment.HNIBR Director Ryu Tae-chul believes that the campaign will encourage recycling in communities to reduce carbon emissions and serve as an inspiration for individuals to actively engage in initiatives that promote a sustainable and biologically diverse planet.

news
Policy & Regulation·

May 23, 2023

Korean Crypto Exchange Alliance Launches Its Official Website

Korean Crypto Exchange Alliance Launches Its Official WebsiteThe Digital Asset eXchange Alliance (DAXA), which comprises South Korea’s five major cryptocurrency exchanges Gopax, Bithumb, Upbit, Korbit, and Coinone, announced the launch of its official website on Tuesday.Photo by Markus Winkler on PexelsWebsite structure and featuresThe website has three primary sections: Introduction, News, and Archives. The Introduction section provides comprehensive information about the exchange, including a greeting from Chairman Lee Sirgoo, who also serves as the CEO of Upbit’s operator Dunamu. It also presents an organizational structure, details of the corporate identity, and links to each individual exchange.The News section provides users with announcements, press releases, and event information. Meanwhile, the Archives section houses educational videos, institutional reports, and a list of important statutes and regulations.Mitigating information disparityDAXA Vice Chairman Kim Jae-jin said the website would offer easy access to information concerning digital assets and the alliance’s self-regulatory measures. She mentioned the group’s commitment to investor protection, focusing on addressing information asymmetry.In addition to the website, DAXA runs a Youtube channel, with its first video uploaded in January of this year.Controversy surrounding the allianceEarlier this year, DAXA faced backlash after it implemented a new clause in its guidelines, which disallowed the re-listing of cryptocurrencies that had been removed from its member exchanges for a period of one year. Critics claimed that DAXA’s guideline was unclear and voiced concerns about the Alliance’s growing influence in the crypto sector. These worries are amplified by the fact that the member exchanges of DAXA command 98% of the crypto trading volume in Korea.

news
Loading