Upbit Suffers $37M Solana Hack Just One Day After $10.3 Billion Naver Acquisition Deal

Upbit, South Korea's dominant cryptocurrency exchange, has confirmed a major security breach resulting in the unauthorized transfer of approximately $37 million (54 billion Korean won) in Solana-network assets. The incident, which occurred on November 27, 2025, comes at a particularly sensitive time – just one day after the announcement of a landmark $10.3 billion acquisition deal with Naver Financial.

The breach was detected at 4:42 a.m. Korean Standard Time when Upbit's security systems identified abnormal withdrawal activity from the exchange's hot wallet. The stolen assets were traced to a single unidentified external wallet, prompting immediate emergency countermeasures.

## Immediate Response and Asset Protection

Within minutes of detecting the suspicious transactions, Upbit took decisive action. The exchange immediately suspended all deposit and withdrawal services across all networks – not just Solana – and began transferring remaining digital assets into secure cold storage facilities designed to block unauthorized access.

Dunamu, Upbit's parent company, initiated on-chain freezing procedures to halt the movement of tokens linked to the breach. These efforts have already proven partially successful, with approximately ₩12 billion (around $8.2 million) worth of LAYER tokens successfully frozen.

Oh Kyung-seok, CEO of Dunamu, issued a statement assuring users that all losses would be fully covered: "To prevent any damage to member assets, the entire amount will be covered by Upbit's holdings."

## Scope of the Attack

The breach affected a wide range of Solana ecosystem tokens, including both established projects and popular meme coins. The stolen assets included SOL, BONK, JUP (Jupiter), RAY (Raydium), ORCA, RENDER, PYTH (Pyth Network), TRUMP (Official Trump), USDC, MEW (Cat in Dog World), Moodeng, Magic Eden (ME), Pengu, Drift Protocol, Huma Finance, IONET, Sonic, and several others.

Security experts have noted that the compromise was isolated to Upbit's hot wallet infrastructure, with cold wallet reserves remaining untouched. The attack appears to have originated from within Upbit's internal systems rather than a vulnerability in the Solana blockchain itself – potentially due to private key exposure, API vulnerabilities, or a compromised signing module.

## A History Repeating Itself

The timing of this incident carries an eerie significance. Exactly six years ago, on November 27, 2019, Upbit suffered its previous major security breach when approximately 342,000 Ethereum tokens – worth around $50 million at the time – were stolen from the exchange. That 2019 hack was later confirmed by South Korean authorities to have been perpetrated by North Korean hacking groups Lazarus and Andariel, with the stolen ETH now valued at over $1 billion.

This new breach marks the most significant security incident at Upbit since that 2019 attack, raising questions about the exchange's security protocols and hot wallet architecture.

## Awkward Timing: The Naver Acquisition

The hack lands at a particularly awkward moment for Upbit and its stakeholders. Just one day prior, on November 26, 2025, Naver Financial – a subsidiary of South Korean internet giant Naver – announced a $10.3 billion all-stock deal to acquire Dunamu, making it one of the largest deals in Asia this year.

The acquisition was designed to create a formidable fintech entity in South Korea, combining Naver's AI capabilities and Naver Pay's 34 million users with Dunamu's blockchain expertise and Upbit's dominant market position. The deal was expected to finalize in June 2026.

Upbit commands approximately 70-80% of South Korea's cryptocurrency trading market, making it the country's undisputed leader. In the first half of 2025 alone, Upbit's cumulative transaction volume reached 833 trillion won (approximately $642 billion). Globally, the exchange consistently ranks among the top 4-5 cryptocurrency exchanges by trading volume.

## Market Impact and Regulatory Response

South Korea is one of the world's most active cryptocurrency trading hubs, with more than 18 million Koreans – over one-third of the population – actively trading digital assets. Daily trading volumes on Korean exchanges sometimes exceed equity market turnover.

Following the breach, financial regulatory authorities in South Korea have initiated an on-site examination to evaluate the ramifications of the incident. This scrutiny comes at a time when Upbit was already under investigation by the Financial Intelligence Unit for potential Know Your Customer (KYC) violations, with reports suggesting 500,000 to 600,000 potential compliance breaches.

## Security Implications for the Industry

This incident is likely to force exchanges across Korea and Asia to re-evaluate their hot wallet architecture, particularly on high-throughput networks like Solana. Security experts suggest it may serve as a catalyst pushing exchanges toward more advanced security models, reducing reliance on simple private keys and increasing adoption of multi-signature or Multi-Party Computation (MPC) solutions.

The exchange has confirmed it is conducting a full security audit of wallet systems and network infrastructure across all supported blockchains. Services will only be restored after every layer passes comprehensive review.

## Looking Forward

Despite the severity of the breach, Upbit's swift response and commitment to full user reimbursement has helped maintain customer confidence. The exchange's ability to cover all losses from its own reserves demonstrates strong financial backing – a factor that may have influenced Naver's acquisition decision.

For the broader cryptocurrency industry, this incident serves as another reminder of the persistent security challenges facing centralized exchanges and the importance of robust security infrastructure, particularly as institutional involvement in the space continues to grow.

As investigations continue, the cryptocurrency community awaits further details on how the breach occurred and what measures will be implemented to prevent similar incidents in the future.