- On November 27, approximately 54 billion won worth of tokens were moved to external wallets.
- To date, approximately 12 billion won of Solaire tokens have been frozen.
- This hacking incident coincided with Dunamu’s major plan to merge with Naver.
Upbit, Korea’s largest cryptocurrency exchange, is conducting a large-scale security inspection after a hacking incident that occurred in the early morning of November 27th, resulting in the unauthorized transfer of Solana-related assets worth about 54 billion won.
The exchange suspended all deposits and withdrawals as it moved digital assets into cold storage and began an extensive internal review.
The incident has refocused attention on how Solana-based tokens are protected across trading platforms and put pressure on Upbit to strengthen its systems as the company enters a major corporate transition involving its parent company, Dunamu.
Solana assets eligible for early transfer
The breach occurred at approximately 4:42 a.m. on November 27, when Solana network assets, including SOL, USDC, and other small tokens, were moved to an external wallet without authorization.
Upbit described this activity as an abnormal withdrawal linked to the Solana network.
The exchange confirmed that approximately $37 million worth of digital assets were affected.
Upbit immediately suspended its services to stop further transmissions.
They announced that they had identified the entire scale of the leak and that they would compensate users in full by covering the amount with their own assets.
Customer balances are not touched during the refund process.
To control risks, exchanges have moved assets into cold storage and initiated system-wide inspections of wallet operations, deposit channels, and withdrawal procedures.
These measures were taken to prevent further unauthorized movement and contain the situation while teams inspected logs and asset flows.
Expanding the scope of system inspection beyond the Solana network
Upbit said the investigation will not be limited to the Solana ecosystem.
We are reviewing the stability and security of a complete deposit/withdrawal infrastructure. This includes a detailed audit of your network connections, wallet systems, and how you store your digital assets.
The exchange has launched an urgent investigation into its internal processes and is conducting a full assessment of whether other networks require additional protection.
Deposits and withdrawals will gradually resume once the inspection is over and the company is satisfied with the security of the system.
The timing amplified industry interest.
The hacking incident occurred a day after Dunamu announced plans to merge with Naver’s fintech division worth billions of dollars.
The deal, worth about $10.3 billion, is one of the largest corporate moves in Asia’s digital finance sector.
According to the report, this could support Upbit’s ambitions for a future Nasdaq listing and put pressure on the company to demonstrate resilience during a sensitive transition period.
Freeze efforts expand as authorities prepare response
Upbit has initiated on-chain measures to track and freeze affected assets.
They said that approximately 12 billion won worth of Solaire tokens have already been frozen, and that they are continuing to cooperate with related projects and institutions to prevent further movement.
The exchange is tracking remaining funds through blockchain monitoring tools and working with partners to identify additional freeze points.
Authorities and law enforcement agencies are also expected to participate in the investigation.
Upbit is prepared to cooperate once official inquiries are launched and has asked users to report any confirmed information related to suspicious transactions.
The company acknowledged the damage caused by the service interruption and reiterated that members’ assets will continue to be protected.
It was also emphasized that the entire outflow will be covered using the exchange’s own resources.
Timing pressure increases with large-scale merger plans
This hacking incident occurred on a day when a significant incident occurred in Upbit’s history.
On the same day in 2019, the exchange lost 342,000 ETH in another high-profile theft incident.
South Korean investigators later linked the incident to North Korean hackers.
The value of the stolen Ethereum has since grown to more than $1 billion, and it still remains one of the largest cryptocurrency heists involving the country.
With deposits and withdrawals still suspended, Upbit plans to resume services in stages after completing a full review.
The exchange said its top priority is protecting infrastructure across all supported networks and strengthening safeguards for assets linked to Solana while recovery and freeze efforts continue.