South Korea woke up on Thursday to one of the largest crypto security incidents the country has seen this year, as Upbit — the nation’s biggest digital asset exchange by trading volume — scrambled to contain a breach that siphoned tens of millions of dollars from its wallets.
Key Takeaways:
Upbit was hacked for about $36.8M in Solana-based assets.
Assets were moved to cold storage and some stolen tokens already frozen.
Users will be fully reimbursed from Upbit’s reserves.
The first signs of trouble emerged before dawn, when Upbit’s monitoring systems detected an unexpected transaction moving funds linked to Solana-based assets. The exchange later confirmed that approximately 54 billion KRW (around $36.8 million) had been transferred to a wallet not controlled by the company.
Instead of gradually disclosing assets one by one, Upbit pulled the emergency brake: withdrawals and deposits were halted across the platform while the exchange began transferring customer holdings into cold storage.
Dozens of Tokens Impacted
While SOL was at the center of the abnormal transfer, the breach touched a wide range of Solana ecosystem tokens — from large network assets like PYTH, RAY, ORCA, BONK, USDC and RENDER to smaller community and meme tokens circulating on the chain.
Security teams have already managed to freeze $8.18 million worth of LAYER tokens, but a significant amount of the stolen holdings is still being traced through the blockchain. Upbit says it is coordinating with token issuers, law enforcement and other exchanges to block further movement of the attacker’s wallet.
Customer Funds to Be Covered
One of the most immediate concerns for users — whether personal funds were lost — has already been addressed. Upbit said it will use its corporate reserves to cover all missing assets, meaning customers will not incur losses from the incident.
The company has not revealed exactly how the attacker gained entry, and no timeline has been provided for when deposits and withdrawals will be restored.
What is clear is that Upbit now faces the dual challenge of recovering stolen funds and restoring confidence — not only among its own users but across a South Korean crypto market that has historically been sensitive to exchange-related breaches.
