South Korea’s largest cryptocurrency exchange, Upbit, temporarily suspended all deposits and withdrawals on November 27, 2025, after detecting an unauthorized outflow of Solana-based tokens from one of its hot wallets. The exchange identified roughly $37 million worth of assets, including SOL, BONK and JUP, being transferred without authorization in the early morning hours, prompting an immediate lockdown of its systems.
Unauthorized Transfer Detected Before Dawn
According to Upbit’s internal review, the suspicious transactions were first detected around 4:42 a.m. local time, triggering an emergency response. Engineers quickly froze all wallet activity and began migrating assets to secure cold storage. The exchange also alerted authorities and confirmed it is working directly with South Korean law enforcement as the investigation progresses.
Upbit emphasized that the issue was limited to a single compromised hot wallet, while all cold wallet reserves remain fully intact and unaffected.
Exchange Commits to Covering All Customer Losses
Dunamu, Upbit’s parent company, stated that the platform will fully cover all user losses using its own funds, ensuring that no customer will bear any financial damage from the incident. This immediate reassurance helped calm market concerns, particularly among Korean retail traders who rely heavily on Upbit’s Solana-based markets.
The company added that normal operations will resume only once all heightened security checks are completed, and wallet systems are fully rebuilt.
Incident Comes at a Sensitive Time for Upbit
The timing of the breach has drawn significant attention. Just one day earlier, Upbit’s operator announced a landmark $10.3 billion stock-swap acquisition deal with Naver Financial, signaling one of the largest fintech mergers in Korean history. The hack also arrives nearly six years to the day after Upbit’s major 2019 security incident, an uncanny coincidence not lost on local analysts.
Despite the disruption, the exchange stresses that the situation is under control and that all customer balances will remain whole once services are restored.
