“Exchange security isn’t a barrier — it’s trust measured in milliseconds of reaction time.”
— Chanphong Kim, founder of Upbit and Dunamu
South Korea’s largest cryptocurrency exchange, Upbit, has officially announced the reopening of deposits and withdrawals for digital assets on December 1, 2025, at 13:00 KST. This decision follows a major hack on November 27, during which attackers stole approximately 44.5 billion KRW ($30–37 million at current rates).
Unlike the 2019 breach, which targeted Ethereum, the attackers this time focused on the Solana ecosystem, stealing SOL, USDC, and the meme token Bonk (BONK). According to investigative groups including Chainalysis and SentinelOne, the incident is likely linked to the North Korean hacking organization Lazarus, known for stealing crypto assets to fund the Kim Jong Un regime.
Upbit emphasized that all old deposit addresses have been invalidated. Users must generate new deposit addresses through the exchange interface before sending assets. Using old addresses may result in delays or loss of funds.
“To improve security and complete a full technical audit of our wallet infrastructure, all digital assets now require newly generated deposit addresses,” the official notice states.
Users are strongly advised to delete all old Upbit addresses from external wallets such as Phantom, Trust Wallet, or MetaMask to avoid accidental future transfers to inactive addresses.
Immediately after detecting unauthorized transactions on November 27, Upbit halted all deposits and withdrawals. The security team, together with token developers, undertook unprecedented actions — successfully freezing $8.18 million worth of assets, including LAYER tokens, rendering them unusable to the attackers.
This measure covered roughly 22% of the stolen funds and was made possible through coordination with project teams that support blacklisting and forced rollback mechanisms.
The recovery process included:
The exchange confirmed that all user losses will be fully compensated using its own reserves. This reinforces trust in the platform, especially compared to cases where other exchanges left victims uncompensated after similar incidents.
For more than 8 years, Upbit has been the leading crypto exchange in South Korea, processing up to 80% of nationwide trading volume. Its reserves are estimated at several billion dollars, making such guarantees financially viable.
Any transfers sent to old addresses between November 27 and December 1 are not lost. They will be processed after the platform reopens, though delays are possible due to manual verification. Upbit warned that processing times may be extended for security reasons.
Additionally, certain assets — such as airdrop tokens, delisted assets, or tokens placed on regulatory “blacklists” — will be eligible for withdrawal only, not deposit.
The attack on Upbit is not an isolated event. In November 2025, the Solana ecosystem experienced a wave of exploits:
The underlying reason is Solana’s surging popularity as the main hub for memecoins and low-fee DeFi activity — which also attracts cybercriminals. According to UN data, Lazarus Group has stolen more than $1.2 billion in crypto since 2022, and Solana’s high liquidity and weaker user-interface defenses made it their new target.
Log in to your Upbit account and update the deposit addresses for all assets you plan to use.
This prevents accidental transfers in the future.
Verify that any funds sent during the outage appear correctly in your account.
Use Google Authenticator or a hardware key — SMS 2FA is vulnerable to SIM-swap attacks.
All important updates are posted on X (Twitter), Telegram, and via email newsletters.
The incident will accelerate new policy adoption across Asia. South Korea is already working on a law requiring exchanges to keep at least 95% of assets in cold storage and undergo annual security audits. Japan and Singapore are considering similar measures.
For users, this signals that the future of crypto security lies in hybrid systems where technology, regulation, and transparency operate together.
The Upbit hack is a reminder that even the most mature platforms are not immune to threats. But the exchange’s response — immediate shutdown, full reimbursement, transparent communication, and infrastructure upgrades — showcases how professionals should handle such crises.
In an era where Lazarus and similar groups have turned crypto hacking into an industry, trust is built not on flawless protection, but on honest recovery. And in this, Upbit has set an example for the entire sector.
