Upbit hacking incident analysis report
Event Overview
Status Confirmed : Officially confirmed. Upbit (operated by Dunamu), South Korea's largest cryptocurrency exchange, confirmed suffering a security attack at 4:42 AM KST on November 27, 2025 (7:42 PM UTC on November 26), resulting in the loss of approximately 54 billion won (about $36 million) in Solana network assets. (coindesk cryptonews)
Key Facts
Attack Details
| project | Details |
|---|---|
| Time of occurrence | November 27, 2025 04:42 KST (November 26 19:42 UTC) |
| Amount of loss | Approximately 54 billion won (~36 million US dollars) |
| Assets involved | Solana ecosystem tokens (SOL, USDC, and other SPL tokens) |
| Attack methods | Abnormal extraction to an unknown external wallet |
Official response
CEO Oh Kyung-seok's statement :
- Upbit has immediately suspended deposit/withdrawal services and is conducting a comprehensive review, prioritizing the protection of member assets.
- "All losses will be borne by Upbit's own assets and will not affect users' assets."
Emergency measures :
- All digital asset deposits and withdrawals will be suspended (starting at 08:55 KST on November 27).
- Transfer the remaining assets to cold storage.
- Initiate wallet and system security audit
- Approximately 12 billion Korean won (about US$8.7 million) of Solayer tokens were frozen.
User Protection Commitment
Full compensation : Upbit has pledged to use its own assets to fully compensate users, and user account balances will remain unaffected. This is consistent with how the 2019 Ethereum hack was handled (at that time, a full compensation of 342,000 ETH, approximately $41.5 million, was paid out). (cryptonews )
social media response
Public opinion analysis
- Overall mood : Relatively calm, mainly neutral.
- Main narrative : Focus on Upbit's proactive response, rather than questioning the Solana protocol.
- Influencer perspectives : As of November 27th UTC, major KOLs have not yet expressed any significant opinions.
- Scope of dissemination : Limited discussion suggests the event may have been effectively controlled or is too recent.
Key social media content
Social media discussion surrounding the incident was relatively limited, with information primarily sourced from official announcements and reposts from news aggregator accounts. No content was found questioning the authenticity of the event or spreading panic. (x.com )
Limitations of technical analysis
On-chain data verification
Current status : Since the event occurred on November 26-27, 2025, the on-chain data has not yet been fully processed by the indexing system, and specific transaction hashes and wallet address tracking cannot be provided at this time.
Identified Upbit Solana addresses :
- BoyUvUrR54j2N2cnfBHL83fBeRjEp9Bhz9D5dgitVdmK (Hot Wallet 3)
- CA1sQYzoaWCku5jSRQqBgjQULYViumUBtyAcaoZB1GN5 (Hot Wallet 10)
- C9f3Z3XKwtfQ4BD8u9edoS2ofBTo9iAcMxSmAUycNgUJ (Hot Wallet 2)
Historical Background and Risk Assessment
Historical precedent
- The 2019 Upbit attack resulted in a loss of 342,000 ETH, later attributed to a North Korean hacking group.
- Handling method : Full compensation was provided to the user, setting a good precedent for crisis management.
Risk factors
- Exchange centralization risk
- Hot wallet security challenges
- Geopolitical cybersecurity threats
in conclusion
The recent hack of Upbit was a confirmed security incident, resulting in the loss of approximately $36 million worth of Solana ecosystem tokens. Upbit's rapid response and commitment to full compensation demonstrate its risk management capabilities. Although the loss was substantial, it remained within a manageable range in the exchange's security history and did not cause direct losses to users.
The relatively mild social media reaction to the incident indicates that the market generally approves of Upbit's handling of the situation. More technical details will be revealed as the investigation progresses and on-chain data availability improves.