Upbit cryptocurrency exchange suffers $36.9 Million hot wallet breach on Solana network
Learn More
Upbit, South Korea's largest cryptocurrency exchange reports a significant security breach on November 27, 2025, which caused unauthorized withdrawals from its hot wallet on the Solana network.
The attack resulted in approximately 54 billion Korean won (around $36.9 million) being transferred to an unspecified external wallet address. CEO Oh Kyung-seok acknowledged the breach in an official notice, explaining that abnormal withdrawal activity was detected on November 27, 2025, at 04:42 UTC.
The breach affected over 20 different tokens operating on the Solana network. The nature of the attack has not been disclosed. Tets and maintain customer trust in the wake of increasing sophisticated cyber attacks targeting centralized platforms.
Upbit suspended all deposit and withdrawal services ib the platform and conducted an emergency security review of its network and wallet systems. The exchange transferred all remaining digital assets to secure cold wallets to prevent any additional unauthorized transfers by the attacker. Upbit claims they succeeded in freezing some of the stolen funds, including approximately 12 billion won worth of LAYER tokens which had been secured. The exchange is working to freeze additional compromised assets where possible and is cooperating with law enforcement agencies and relevant institutions to track the remaining assets and investigate the incident.
CEO Oh Kyung-seok pledged that Upbit would assume full financial responsibility for the breach and promised that the entire amount would be covered by Upbit's assets to ensure no damage to members' holdings. The company has established a customer service line for users with questions or suspicious information regarding the abnormal withdrawal activity and continues to monitor the situation closely.
According to reports from BlockTempo on Twitter, South Korea's financial regulator has launched an investigation into Upbit concerning delayed reporting of the incident and potential data-handling issues.
