Upbit hack impacts Solana token; deposits and withdrawals suspended for tokens like ORCA, but trading continues.

Event Overview

Attack Confirmed : Upbit, South Korea's largest cryptocurrency exchange, suffered a security attack at 4:42 AM KST on November 27, 2025 (7:42 PM UTC on November 26), resulting in the unauthorized transfer of approximately 54 billion won (about $36-38 million USD) of Solana ecosystem assets to external addresses. This was not routine maintenance, but a hacking incident confirmed by the CEO of Upbit operator Dunamu. (coindesk)

Immediate Response : Upbit immediately suspended all deposit and withdrawal services for Solana network assets, transferred remaining assets to cold wallets, and pledged to fully compensate users for their losses using its own reserves. beincrypto

Affected tokens and transaction status

List of affected assets

Approximately 24 Solana SPL tokens were affected, but spot trading of all tokens on Upbit (such as ORCA/KRW, BONK/KRW, SOL/KRW, etc.) continued normally; only deposit and withdrawal functions were suspended .

Recovery schedule

As of November 27 UTC time, Upbit has not yet announced a specific timeline for service restoration, only stating that it will "gradually restore" the Solana network service after the security audit is completed.

Price performance and volatility analysis

Core token price performance

Volatility characteristics

ORCA performed exceptionally well : Following the news of the attack, ORCA saw a significant increase, rising 24.3% within 28 hours after the pause. This was mainly due to the high level of attention from South Korean retail investors to the Solana ecosystem token and news-driven trading activity.

BONK and PENGU were relatively stable : Although both tokens were affected, their price reactions were relatively mild, indicating that the market had different perceptions of the impact of the event.

Exchange Comparison

Community sentiment and market reaction

Overall emotional tendency

Neutral to slightly positive : Social media discussions indicate that Upbit's promise of full refunds effectively alleviated user panic and prevented a large-scale sell-off. x.com

Main narrative themes

Damage control was highly effective : The community generally believes that Upbit's rapid response and compensation commitment demonstrated a sense of responsibility, classifying the incident as a "controllable event" rather than a systemic risk. x.com

Limited skepticism regarding the Solana ecosystem : While some have questioned the cybersecurity of Solana, there is a lack of substantial evidence to suggest that the attack was related to the Solana protocol itself, and is more likely a problem with the exchange's infrastructure. x.com

Small-cap currency specific reactions

Discussions surrounding smaller cryptocurrencies like ORCA, BONK, and PENGU have been relatively neutral. The community views them as "collateral damage" from a larger event, interpreting short-term fluctuations as trading opportunities rather than signals of ecosystem decline. x.com

Key conclusions

1. Nature of the incident : Confirmed to be a security attack targeting Upbit, not a Solana network issue.
2. Impact of the transaction : Deposits and withdrawals were suspended, but spot trading continued as normal, thus averting a liquidity crisis.
3. Price divergence : ORCA benefited from news-driven gains, while other tokens remained relatively stable.
4. Emotional Management : Upbit's compensation commitment effectively maintained market confidence.
5. Recovery Expectation : Service restoration time is pending, but historical experience shows it typically resolves within 24-48 hours.

Although this incident involved a large sum of money, Upbit's professional handling and the market's rational response indicate that the systemic risk of security incidents at centralized exchanges is decreasing.