Upbit halts withdrawals after $38.5M theft on the Solana network

System monitoring detected the incident in the early hours of November 27, Korea time. The company’s tools flagged a series of suspicious transactions involving a whole basket of Solana ecosystem tokens. It was not just SOL and stablecoins but also popular meme coins and DeFi assets, including BONK, JUP, ORCA, PYTH, RAY, JTO, RENDER and others.

Once the security team confirmed that it was dealing with an unauthorized outflow of funds, Upbit moved the remaining assets to cold wallets. This step stopped any further drain of funds and confined the incident to the affected addresses on the Solana network.

Upbit also said that, together with project teams and infrastructure partners, it managed to freeze part of the stolen tokens worth about 12 billion Korean won. The rest of the funds are being tracked on-chain. At the same time, the exchange has launched an unscheduled audit of the infrastructure that handles Solana deposits and withdrawals and is preparing to update its internal security procedures.

The management of parent company Dunamu stressed that customers will not suffer direct financial losses. CEO Oh Kyung-sok stated that all damages will be covered from the company’s own funds. According to him, the size of the loss has already been fully assessed and user balances will be restored in full.

At the moment, deposits and withdrawals are suspended not only on the Solana network but also on several other rails. Upbit says this is necessary to run a comprehensive check of all systems that handle asset transfers. The exchange plans to restart operations gradually. Each blockchain will be brought back online only after technical checks are completed and the stability of the wallets is confirmed.

The Solana incident is not the first serious test of the exchange’s security. In 2019, Upbit lost about 342,000 ETH from a hot wallet, which at the time was worth tens of millions of dollars. Back then, the company also promised to cover the losses from its reserves and later tightened its storage procedures.

In 2023, the exchange faced another high-profile case involving fake APT tokens. Attackers used a fraudulent smart contract and managed to get a token listed that mimicked the real Aptos asset. After discovering the problem, Upbit temporarily suspended APT deposits and withdrawals, reviewed its wallets and worked with users who had already bought or sold the counterfeit coins.

Upbit launched in 2017 and within a few months became one of South Korea’s leading crypto exchanges by trading volume. The platform is owned by Dunamu, and its core market is domestic. Today, the exchange lists hundreds of trading pairs and is considered one of the key liquidity hubs in the Korean crypto market.

As a reminder, the fintech arm of tech giant Naver, Naver Financial, is preparing to acquire Upbit’s operator Dunamu in a stock-swap deal. For the exchange, this is an opportunity to tap the resources and infrastructure of a large IT holding company.