Upbit: KRW 54 billion worth of virtual assets leaked…will fully compensate from exchange funds

A leakage of Solana (SOL)-based virtual assets worth KRW 54 billion occurred at domestic virtual asset (cryptocurrency) exchange Upbit. Assets leaked from the exchange will be fully covered by Upbit's assets.

According to Upbit's official statement, on the morning of the 27th, the Upbit operations team, having detected signs of abnormal withdrawals, urgently conducted an inspection of the digital asset deposit and withdrawal service. Upbit stated, "As soon as abnormal withdrawal activity was detected in some Solana network-related digital assets, we prioritized the protection of members' assets, suspended deposit and withdrawal services, and carried out a full inspection."

Due to the abnormal withdrawal activity, some Solana network-related assets (approximately KRW 54 billion) flowed into unknown wallets, and Upbit moved all assets to secure cold wallets to prevent additional abnormal transfers.

Upbit explained, "We have moved all assets to cold wallets, and are preparing on-chain freezing attempts and cooperation with investigative agencies. We have frozen some of the leaked assets (approximately KRW 12 billion worth of Solayer), and are continuously tracking the remaining assets. We are working with related projects and institutions to pursue additional asset freezes."

They added, "We apologize for causing concern due to this abnormal withdrawal, and are conducting a wide-ranging inspection of the security of the entire digital asset system as well as the Solana network-related assets. The loss incurred will be fully covered by Upbit's held assets, so member assets will not be affected."

<Upbit full notice>

This is Oh Kyung-seok, CEO of Dunamu, which operates Upbit.

First, I deeply apologize for causing concern to members due to the urgent inspection of digital asset deposit and withdrawal services and the abnormal withdrawal situation carried out today.

As soon as abnormal withdrawal activity was detected in some Solana network-related digital assets, Upbit prioritized the protection of members' assets, suspended deposit and withdrawal services, and conducted a comprehensive inspection process.

The scale of digital asset leakage caused by abnormal withdrawals was identified as soon as it was confirmed, and we reiterate that the full amount will be covered by Upbit's assets so that no damage occurs to members' assets.

Below is guidance on Upbit's actions since the abnormal withdrawal activity occurred.

Upbit confirmed around 2025-11-27 04:42 that some Solana network-related assets (approximately KRW 54 billion) were transferred internally to wallet addresses not designated by us (unknown external wallets).

Target digital assets: Double Zero (2Z), Access Protocol (ACS), Bonk (BONK), Doodles (DOOD), Drift (DRIFT), HUMA Finance (HUMA), IOnet (IO), Jito (JTO), Jupiter (JUP), Solayer (LAYER), Magic Eden (ME), Cat in a Dog's World (MEW), Moodeng (MOODENG), Orca (ORCA), Pudge Penguin (PENGU), Pyth Network (PYTH), Raydium (RAY), Render Token (RENDER), Solana (SOL), Sonic SVM (SONIC), Soon (SOON), OfficialTrump (TRUMP), USD Coin (USDC), Wormhole (W)

Afterward, Upbit immediately conducted an emergency security review of the relevant networks and wallet systems upon detecting the abnormal withdrawals.

To protect members' assets, Upbit is taking the following measures immediately.

1. Moved all assets to secure cold wallets to prevent additional abnormal transfers.

2. On-chain freezing attempts and preparation for cooperation with investigative agencies

We are taking on-chain measures to freeze related digital asset transactions to the extent possible and have completed freezing some assets (approximately KRW 12 billion worth of Solayer).

We are continuously tracking the remaining assets and are working with related projects and institutions to pursue additional asset freezing measures.

3. Comprehensive deposit and withdrawal security inspection

We are conducting a broad inspection of the stability and security compliance of the entire digital asset deposit and withdrawal system, not only for Solana network-related assets. Deposit and withdrawal services will be resumed sequentially as safety is ensured.

The scale of losses caused by the abnormal withdrawals has been internally identified as soon as confirmed, and we once again inform you that the losses will be fully covered by Upbit's held assets so that no damage occurs to member assets.

If you have any verifiable information or suspicious content related to the abnormal withdrawal activity, please report it through customer service.

We deeply apologize once again for causing concern due to this abnormal withdrawal situation.

Upbit will do its best to provide safer services based on an even stronger security system, with members' assets as the top priority.

Thank you.

Oh Kyung-seok, CEO of Dunamu