The Upbit hack was reported to regulatory agencies more than 6 hours late.

According to the Chosun Ilbo, Upbit reported the hacking incident to financial regulators more than six hours after it occurred. Upbit may have delayed disclosing the incident to avoid media shock, as its parent company, Dunamu, is currently pursuing a merger with tech giant Naver. The Financial Supervisory Service (FSS) of Korea reported that Upbit held an emergency meeting 18 minutes after first detecting the attack (at 5:00 AM), suspended access to assets on the Solana network 27 minutes later, and suspended all digital asset deposits and withdrawals from 8:55 AM, but did not report it to the FSS until 10:58 AM. Despite the delayed reporting, regulators currently lack legal provisions for direct penalties or mandatory compensation.