South Korea’s largest crypto exchange reported that on 27 November assets were withdrawn from a hot wallet on the Solana network.

Incident details

Upbit confirmed that attackers removed roughly $36 million in assets from a Solana-based hot wallet on 27 November. The exchange temporarily suspended several operations and moved remaining balances into cold storage while investigating the breach.

Stolen assets and containment

The list of affected tokens includes BONK, MOODENG, TRUMP, multiple DeFi tokens, SOL and USDC. Exchange reports indicate that a portion of the stolen funds has already been frozen through on-chain interventions and partner cooperation.

Corporate response and customer coverage

Dunamu, the parent company of Upbit, stated it will cover losses and fully compensate affected users. The company says it is conducting a full security audit and will resume normal operations only after completing the review.

Next steps and monitoring

Upbit has launched an internal investigation and is coordinating with blockchain analytics and law enforcement to trace the transfers. The exchange also plans additional safeguards to prevent future compromises of hot wallets.