The Upbit Hack Explained: A Solana Hot Wallet Drained
Quick answer. On November 27, 2025, about 44.5 billion won (about $30 million) left Upbit's Solana hot wallet; Upbit pledged to cover customer losses. The cause is unconfirmed. The checks: signing code, admin access to hot wallets and outflow alerts.
Video transcript
In November 2025, Upbit's Solana hot wallet was drained. Upbit says it covered customer losses in full, but the cause is still unconfirmed.
Most of it was customer assets. Upbit first reported about 54 billion won, then corrected it to about 44.5 billion won, roughly 30 million dollars.
At about 4:42 a.m. Korean time, funds went to an unknown wallet. About 45 minutes later, Upbit halted Solana deposits and withdrawals. It moved remaining assets to cold wallets and reopened network by network.
Three accounts are on record, none confirmed. Upbit later found and fixed a key-exposure flaw, and Halborn points to weak signing data, but neither is proven to be the cause. A government official suggested compromised admin accounts.
South Korean authorities suspected North Korea's Lazarus Group, Yonhap reported, citing anonymous sources. CertiK saw echoes of past Lazarus attacks, but no definitive onchain evidence yet. It is a suspicion, not a finding.
Whatever the cause, four lessons stand. Treat signing code as part of key custody, and protect admin accounts like keys. Keep hot balances small, and rehearse the stop.
Guardian's Infrastructure Pentest escalates through cloud accounts like an intruder, until something signs. It tests secrets handling, data at rest, vendor consoles and cloud posture.
Read the full explainer, or talk to Guardian about testing every path to your hot wallet signer.
The Upbit hack hit what Halborn calls South Korea's largest exchange. It came as Dunamu, Upbit's operator, was set to be absorbed into Naver Financial, Decrypt reported.
Upbit has published detailed loss figures but no confirmed cause. Three explanations are on record, and this explainer keeps each one attributed and separate.
What Happened
At about 04:42 KST on November 27, 2025 (19:42 UTC on November 26), part of Upbit's Solana-network assets moved to a wallet it had not designated.
Upbit called it an unknown external wallet. Its notice lists 24 affected tokens, including SOL, USDC, BONK, JUP and TRUMP.
At 05:27 KST, Upbit halted Solana-network deposits and withdrawals, citing a wallet system check. At 08:55 KST, it announced an emergency check of all deposit and withdrawal services.
It moved its remaining assets to cold wallets. It said its cold wallets suffered no breach or theft.
Dunamu CEO Oh Kyung-seok said Upbit would cover the full loss with its own assets, so members' assets would not be harmed.
How the Attack Worked
We found no published finding by investigators. These are the three accounts on record.
1. A flaw Upbit found afterward
On November 28, Upbit said its post-incident inspection found a security flaw in its own systems. Analyzing many public Upbit wallet transactions could let someone estimate its private keys.
Upbit said it fixed the flaw. It did not say the flaw caused the theft; Cryptonews reported that Upbit "has not established a direct link."
2. Halborn's signing explanation
Halborn writes that Upbit's digital signature algorithms "produced weak or predictable signing data." An attacker could use that to derive private keys from past onchain transactions.
Halborn is explicit that this "hasn't been proven to be the cause of the incident." It says the flaw would explain how attackers could have accessed the hot wallet.
3. An official's admin-account theory
A government official told Yonhap the hackers likely compromised administrator accounts, or impersonated administrators, to authorize the transfers. The Block reported this.
Upbit's notices reviewed here do not mention this theory.
Who is suspected
On November 28, Yonhap reported that South Korean authorities suspected North Korea's Lazarus Group, The Block and Decrypt said.
Yonhap cited anonymous government and industry sources. It said authorities were preparing an on-site inspection of Upbit.
That is a suspicion, not a finding. CertiK told Decrypt the withdrawals were "reminiscent of previous Lazarus-related attacks," but it had no "definitive evidence on the chain yet."
South Korean police concluded in 2024 that Lazarus carried out the 2019 theft of 342,000 ETH from Upbit, The Block reported. Our Lazarus Group playbook covers the group's known methods.
Timeline and Loss
| Time (KST) | Event | Source |
|---|---|---|
| Nov 27, about 04:42 | Solana-network assets sent to an unknown wallet | Upbit |
| Nov 27, 05:27 | Solana-network deposits and withdrawals halted | Upbit |
| Nov 27, 08:55 | Emergency check of all deposits and withdrawals | Upbit |
| Nov 27, 12:33 | Notice: about 54B won sent out | Upbit, Decrypt |
| Nov 27, 15:02 | Loss corrected to about 44.5B won | Upbit |
| Nov 28 | Yonhap: authorities suspect Lazarus | The Block, Decrypt |
| Nov 28, 18:02 | CEO apology; key-exposure flaw found and fixed | Upbit |
| Nov 28, 23:45 | Deposits and withdrawals resume on first networks | Upbit |
| Nov 30 to Dec 1 | More networks resume in stages | Upbit |
| Dec 6 | Check and resumptions declared complete | Upbit |
How much was taken
Upbit's notice at 12:33 KST on November 27 put the outflow at about 54 billion won. Decrypt converted that to about $36 million.
At 15:02 KST the same day, Upbit corrected it to about 44.5 billion won, valuing the assets at 04:42 prices. The Block converted that to about $30.4 million.
On November 28, Upbit broke the total down:
| Part | Amount, per Upbit |
|---|---|
| Customer assets | About 38.6B won |
| Of which frozen | About 2.3B won |
| Upbit's own assets | About 5.9B won |
| Total | About 44.5B won |
The frozen 2.3 billion won was in Solayer (LAYER) tokens. Upbit first put that freeze at about 12 billion won, then corrected it.
Onchain, Dethective said a wallet apparently tied to the hacker swapped SOL for USDC and was bridging funds to Ethereum, The Block reported.
Recovery
Upbit said customer losses were covered in full from its own assets. In its apology, the CEO said the breach stemmed from inadequate security management at Upbit.
Upbit deleted every existing deposit address and required customers to issue new ones. It tied the change to fixing the flaw and checking its wallet system.
What It Shows
The cause is still open. These lessons come from the accounts above and Upbit's response, not from a finding of fault.
Signing code is part of key custody
If signatures can leak a key, every past transaction is evidence for an attacker. Upbit replaced all deposit addresses after finding such a flaw.
Admin access is a path to the signer
If the official's theory is right, no key had to be broken. Admin accounts that can authorize transfers need the same protection as keys.
Keep hot balances small
Upbit said its cold wallets were untouched, so the loss was limited to the hot wallet. Our hot wallet monitoring guide covers balance bands and automatic halts.
Rehearse the stop
Upbit's first halt notice came about 45 minutes after the transfer. It then moved funds to cold storage and reopened network by network.
Our Binance hack explainer shows why a pause must reach the signer.
How Infrastructure Pentest Tests This
Guardian's Infrastructure Pentest covers "the servers, accounts, and vendors your protocol depends on." It escalates through cloud accounts like an intruder, until something signs.
Upbit's cause is unconfirmed, so no single area maps to it. These are the areas on the service page closest to the accounts above:
- Secrets handling: where keys and tokens live, who can read them, and rotation.
- Data at rest: encryption and key custody, and backups.
- Vendor consoles: SaaS accounts that can change production, like identity, and who holds admin.
- Cloud posture: IAM and trust policies, and what one stolen key unlocks.
Teams can scope a whole account, or narrow it to services like IAM and key management. For keys, signers and privileged roles themselves, Guardian also runs an OpSec Audit.
See the Infrastructure Pentest page.
Frequently Asked Questions
How much was stolen in the Upbit hack?
Upbit first reported about 54 billion won, about $36 million per Decrypt. It corrected that to about 44.5 billion won at 04:42 prices: 38.6 billion won of customer assets and 5.9 billion won of its own.
What caused the Upbit hack?
It is unconfirmed. Upbit found and fixed a flaw that could expose private keys, but did not tie it to the theft. Halborn says the flaw is not proven to be the cause. An official suggested compromised admin accounts.
Was North Korea behind the Upbit hack?
It is suspected, not confirmed. Yonhap reported on November 28, 2025 that South Korean authorities suspected the Lazarus Group, citing anonymous sources. CertiK saw similarities to past Lazarus attacks but no definitive onchain evidence.
Did Upbit customers lose money?
Upbit said it covered customer losses in full from its own assets. It froze about 2.3 billion won in Solayer tokens and required new deposit addresses when services reopened.
Sources
- Upbit: Temporary halt of Solana-network deposits and withdrawals for a wallet system check, in Korean (November 27, 2025)
- Upbit: Emergency check of digital asset deposit and withdrawal services, in Korean (November 27, 2025, updated December 6)
- Upbit: Notice on the emergency inspection of digital asset deposits and withdrawals, in Korean (November 27, 2025, updated 15:02 KST)
- Upbit: Apology to members from Dunamu CEO Oh Kyung-seok, in Korean (November 28, 2025)
- Upbit: Staged resumption of digital asset deposits and withdrawals, in Korean (November 28, 2025)
- Upbit: Staged resumption, 40 networks, in Korean (November 30, 2025)
- Decrypt: South Korea's Upbit Reports $36 Million Loss in Solana Hot-Wallet Breach (November 27, 2025)
- The Block: North Korea's Lazarus Group suspected in $30 million Upbit hack, report (November 27, 2025, EST)
- Decrypt: Upbit Hack Attributed to North Korea's Lazarus as Seoul Opens Probe, Report (November 28, 2025)
- Cryptonews via Yahoo Finance: Upbit Finds Critical Wallet Flaw Amid Probe Into $30M Hack (November 29, 2025)
- Halborn: Explained, The Upbit Hack (November 2025) (December 4, 2025)
Test every path to your hot wallet signer
Guardian's Infrastructure Pentest attacks your cloud accounts, secrets and vendor consoles the way an intruder escalates toward something that signs.