South Korea’s Upbit Reports $36 Million Loss in Solana Hot-Wallet Breach

In brief

Upbit said irregular transfers on the Solana network drained about $36 million across multiple tokens, including BONK, JTO, SONIC, and USDC.
The exchange moved remaining funds offline and is coordinating on-chain freezes with issuers after securing a portion of Solayer tokens.
The CEO of Dunamu, Upbit’s parent, said the exchange will fully reimburse customers.

South Korea’s largest crypto exchange, Upbit, disclosed a security incident involving assets on the Solana network on Thursday, reporting losses of roughly $36 million as the platform moved to contain the breach.

The exchange said it detected irregular withdrawals linked to a compromised hot-wallet address, prompting it to halt some services while investigators traced the flow of funds.

“At around 04:42 on 2025-11-27, Upbit confirmed that a portion of Solana network assets (approximately 54 billion KRW worth) had been transferred to a wallet address not designated internally (an unknown external wallet),” a rough translation of Dunamu CEO Oh Kyung-seok’s public notice reads.

Affected assets include meme coins such as Bonk (BONK), Moodeng (MOODENG), Official Trump (TRUMP), and decentralized finance tokens such as Sonic SVM (SONIC), Access Protocol (ACS), Jito (JTO), Solana (SOL), and Raydium (RAY), among other tokens such as Pudgy Penguin (PENGU). The list also includes Circle’s USD Coin (USDC).

“The scale of the loss caused by the abnormal withdrawals was identified internally immediately upon confirmation,” Oh said, adding that Upbit will “fully compensate the entire amount with its own assets so that no impact occurs to members’ assets.”

Upbit said it has initiated an emergency security review of all related networks and wallet systems immediately after detecting the irregular transfers.

Per Oh’s notice, the exchange moved all remaining assets into cold storage to prevent additional abnormal withdrawals, and it is coordinating on-chain freeze attempts with relevant projects after successfully freezing a portion of Solayer (LAYER).

Upbit added that broader deposit and withdrawal services will resume only after systemwide security checks are completed.

The suspected hack comes as Dunamu, Upbit’s parent company, has been navigating one of its most consequential corporate transitions in years, with the firm set to be absorbed into Naver Financial under a $10.3 billion stock-swap agreement.

Decrypt reached out to Dunamu for comment. This is a developing story.