Upbit Exchange Breached for $30.4 Million as South Korea Probes Lazarus Group Link

South Korea’s largest cryptocurrency exchange, Upbit, has fallen victim to a sophisticated cyberattack that resulted in the theft of approximately $30.4 million in digital assets. The breach, detected on November 28, 2025, has sent shockwaves through the Asian crypto market and prompted an immediate investigation by South Korean authorities who suspect the involvement of North Korea’s notorious Lazarus Group.

The Exploit Mechanics

The attack began with the detection of abnormal withdrawal patterns involving several Solana-based tokens on the Upbit platform. According to early findings shared with Yonhap News Agency by government and industry sources, the attackers gained access to administrative accounts on the exchange. Investigators believe they either impersonated staff members or compromised credentials to authorize unauthorized transfers. This approach indicates targeted account manipulation rather than a direct assault on Upbit’s server infrastructure, a hallmark of Lazarus Group operations.

Upbit initially estimated losses at approximately $38 million but revised the figure downward to $30.4 million (44.5 billion won) after completing a comprehensive asset review. The exchange acted swiftly, pausing all deposits and withdrawals within minutes of detecting the anomalous activity.

Affected Systems

The breach primarily affected Solana-based token holdings on the exchange. Blockchain analysis provider Dethective reported that a wallet linked to the suspected hacker immediately began moving funds after the theft. The attacker converted stolen Solana tokens into USDC and began transferring assets to the Ethereum network through cross-chain bridges, following a laundering pattern commonly observed after major cryptocurrency thefts.

The timing of the breach adds another layer of complexity. Just one day before the hack, Naver Financial confirmed it would acquire Upbit’s parent company, Dunamu, as a wholly owned subsidiary. This corporate transition means Upbit now faces both a critical security incident and a structural reorganization simultaneously, raising questions about whether the transition period may have created exploitable gaps in security protocols.

The Mitigation Strategy

South Korean regulators have arranged an on-site inspection of Upbit to identify vulnerabilities and understand exactly how the attackers gained internal access. The review will examine the exchange’s administrative access controls, multi-factor authentication requirements, and withdrawal approval processes.

For users, the incident underscores the persistent risks associated with keeping large amounts of cryptocurrency on centralized exchanges. While Upbit’s rapid response in freezing deposits and withdrawals likely prevented greater losses, the $30.4 million theft represents a significant failure in access control and administrative account protection.

Lessons Learned

This breach bears striking similarities to Upbit’s 2019 hack, in which 342,000 ETH were stolen. South Korean police concluded last year that Lazarus was responsible for that earlier theft. The recurrence of a similar attack on the same exchange raises serious concerns about whether sufficient security improvements were implemented after the first incident.

Key takeaways from this incident include the critical importance of securing administrative accounts with hardware-based multi-factor authentication, implementing time-locked withdrawal limits for large transfers, maintaining continuous monitoring for anomalous transaction patterns, and ensuring that corporate transitions do not weaken security postures.

User Action Required

Upbit users should monitor their accounts for any unauthorized activity, enable all available security features including two-factor authentication, and consider transferring significant holdings to personal hardware wallets rather than keeping them on the exchange. Users who may have been affected by the breach should contact Upbit’s customer support and document any suspicious transactions. As the investigation unfolds, additional guidance from both Upbit and South Korean regulators is expected in the coming days.

Disclaimer: This article is for informational purposes only and does not constitute financial advice. Readers are encouraged to conduct their own research before making any investment decisions.