Upbit, South Korea’s largest cryptocurrency exchange, announced a significant security breach resulting in the theft of approximately 54 billion won (around 36 million dollars) worth of assets based on the Solana 
$139 blockchain. The exchange assured that user assets remain unharmed and that Upbit will cover the entire loss.
Solana Ecosystem Targeted in the Attack
Initial findings from Upbit indicated that the incident began around 04:42 a.m. local time with unusual transfers. Various coins from the Solana ecosystem, including SOL, USDC, BONK, RENDER, ORCA, JUP, PYTH, and IO, were transferred to an unidentified wallet. CEO Oh Kyung-seok emphasized that the protection of user assets is the company’s top priority, and that Upbit would compensate for all losses from its own resources. The exchange confirmed that user balances remain secure.
Deposit and withdrawal activities on the platform were halted in the morning as Upbit initiated security checks by freezing systems and transferring assets to cold wallets. While continuing internal blockchain tracking, the team announced that approximately 12 billion won worth of Solaire (LAYER) coins had been frozen, and the remaining assets were still being monitored. The exchange highlighted its close collaboration with related projects and authorities.
Security Concerns Resurface for Upbit After Six Years
The incident occurred nearly on the same day as a significant hack in 2019 when 342,000 ETH were stolen from Upbit. This previous attack was later confirmed to be linked to North Korea. Although there appears to be no direct connection with the new attack, the historical coincidence is notable. The ETH stolen back then has now escalated in value to over a billion dollars.
The timing of this attack coincides with a critical juncture, as South Korea’s tech giant Naver is reportedly preparing to acquire Upbit’s parent company, Dunamu, through a multi-billion-dollar stock exchange deal. This security breach at such a time puts additional pressure on the exchange; however, Upbit’s decision to bear the loss is considered a strategic move to maintain trust. The company announced that transactions would be gradually reopened following the completion of security checks.
