South Korea’s largest cryptocurrency exchange, Upbit, confirmed that approximately 54 billion Korean won ($36.9 million) worth of Solana-based assets were transferred to an unauthorized wallet address in the early hours of November 27, 2025. The breach represents the most significant security incident at the exchange since the infamous 2019 Ethereum theft, and it has sent shockwaves through the Asian crypto market at a time when Bitcoin trades near $90,850 and Ethereum hovers around $2,990.
The Exploit Mechanics
At approximately 04:42 KST on November 27, Upbit’s internal monitoring systems detected abnormal outflows from its Solana hot wallet infrastructure. The unauthorized transfers encompassed a broad range of Solana ecosystem tokens, including SOL, USDC, BONK, JUP, RAY, RENDER, ORCA, and PYTH. The diversity of tokens targeted suggests the attacker gained access to the hot wallet’s private keys rather than exploiting a specific smart contract vulnerability.
The timing of the breach proved particularly sensitive, occurring mere hours after Upbit’s parent company Dunamu finalized a high-profile merger deal with Naver’s fintech arm, Naver Financial. Dunamu CEO Oh Kyung-seok addressed the incident during a joint press conference, assuring the public that the exchange would cover the full amount lost using its own assets to ensure no customer funds would be impacted.
Affected Systems
Upbit immediately suspended all Solana network deposit and withdrawal services upon detecting the breach, implementing emergency inspection protocols across its infrastructure. The hot wallet system, which maintains a portion of exchange assets in online-connected storage to facilitate rapid trading, was the sole component compromised. Cold storage reserves, holding the vast majority of customer funds, remained untouched throughout the incident.
The affected tokens paint a picture of an attacker with intimate knowledge of the Solana ecosystem’s most liquid assets. SOL remains the network’s native token, while USDC represents the dominant stablecoin on Solana. BONK, JUP, RAY, RENDER, ORCA, and PYTH collectively represent billions in daily trading volume across decentralized and centralized exchanges.
The Mitigation Strategy
Upbit’s response followed established incident response protocols. The immediate suspension of Solana network services prevented further unauthorized withdrawals while security teams conducted a comprehensive forensic analysis. Dunamu committed to full reimbursement from corporate assets, a move that underscores the financial reserves maintained by South Korea’s dominant exchange operator.
Security researchers note that the 2025 incident shares similarities with the 2019 breach, which saw approximately 340,000 Ethereum tokens worth 58 billion won stolen from Upbit. In that earlier case, the exchange similarly absorbed the losses entirely without passing costs to customers. However, the recurrence after six years raises questions about hot wallet security evolution at major exchanges.
Lessons Learned
The Upbit breach highlights the persistent vulnerability of hot wallets, regardless of an exchange’s size or resources. Even as cold storage technology has advanced significantly, the operational necessity of maintaining liquid hot wallets for real-time trading creates an unavoidable attack surface. The incident also demonstrates that multi-token ecosystems like Solana amplify risk, as a single compromised private key can expose dozens of distinct assets simultaneously.
For the broader market, the breach arrives during a period of relative stability, with Bitcoin holding firm above $90,000 and total crypto market capitalization exceeding $2.6 trillion. The measured market response suggests growing maturity among traders, who appear to differentiate between exchange-specific security incidents and systemic protocol risks.
User Action Required
Upbit users should monitor official communications from the exchange regarding the resumption of Solana network services. Those with significant Solana-based holdings on any exchange should consider transferring assets to personal hardware wallets as a precautionary measure. Users should also enable all available security features, including two-factor authentication and withdrawal whitelist restrictions, to minimize exposure to potential follow-on attacks.
This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making trading decisions.
54 billion won in Solana tokens stolen because of a hot wallet. cold storage exists for a reason people
hot wallets are necessary for liquidity but $36M in a single hot wallet is negligent. tiered hot wallets with $5M caps would have limited the damage
kwik_draw 5M cap per hot wallet would have limited this to a minor incident. 36.9M in one hot key is indefensible in 2025
cold_wave is spot on about the 5M cap. FTX had similar concentration risk. one hot wallet holding everything is just hoping today isnt the day
Dunamu CEO covering losses from company assets is the right move. but this is the second major breach. trust doesnt survive too many of these
the attacker knew the Solana ecosystem well. SOL, BONK, JUP, RAY, RENDER, ORCA, PYTH… thats every major token
the attacker hitting SOL BONK JUP RAY RENDER ORCA PYTH means they had full private key access not a specific token exploit. inside job or key compromise
astrid l private key access to every major solana token means this wasnt some smart contract bug. someone had the keys or the hsm failed
hot_cold_split the token list is basically every major Solana ecosystem project. whoever did this knew exactly what they were grabbing
Naver Financial closes the Dunamu acquisition and hours later the exchange gets hacked. terrible optics for everyone involved
naver finalizes the dunamu acquisition and within hours the exchange gets drained for 54 billion won. the timing is almost too perfect
min jae h naver closed the dunamu deal and hours later the hot wallet keys were gone for 36.9m
naver closes the dunamu deal and hours later 36.9M vanishes from the hot wallet. the timing alone warrants a full audit
key_split_advocate the timing of the Naver deal closing and the hack is too clean. korean authorities should be investigating insider access not just external threats
Upbit handled the PR better than most. opened withdrawals within 48 hours and covered all losses. but the fact that 8 different SPL tokens were drained says the hot wallet had zero segmentation
Dunamu covering losses from company assets is good for users but raises questions about their reserve adequacy going forward. second major breach since 2019
upbit lost 54 billion won in sol usdc bonk jup ray render orca pyth from one hot wallet on nov 27
dunamu had just closed the naver deal when this happened. korean press was speculating about insider access for weeks
8 different SPL tokens drained means zero segmentation. SOL BONK JUP RAY RENDER ORCA PYTH all from one key. indefensible in 2025
SOL BONK JUP RAY RENDER ORCA PYTH all drained from one key. thats not a hot wallet thats a give-us-everything wallet
tenz exactly. one key holding 8 token types is just bad segmentation. even a basic per-token wallet setup would have capped this at 5M
tenz_w one key holding SOL BONK JUP RAY RENDER ORCA PYTH is not a hot wallet its a disaster waiting to happen. basic per token segmentation would have capped this
naver finalizes the dunamu deal and within hours the hot wallet gets drained. korean authorities should be looking at insider access not just external hackers
Dunamu covering losses from company assets sounds great until you ask where that money comes from. second major breach since 2019 and the reserve pile isnt infinite