Upbit Breach Timed to Merger Sparks Sanctions and Security Debates

Upbit, South Korea's largest cryptocurrency exchange, reported a 54 billion won ($36–$37 million) loss following a cyberattack on its Solana network hot wallet on Nov. 27, 2025. The breach, which prompted immediate suspension of deposits and withdrawals, has drawn scrutiny from regulators and cybersecurity experts who suspect the North Korea-linked Lazarus Group as the perpetrator according to reports. The timing of the incident—coinciding with a major merger announcement between Upbit's parent company, Dunamu, and tech giant Naver—has fueled speculation about the attackers' intent to exploit heightened public attention as research shows.

Authorities, including the Ministry of Science and ICT and the Financial Supervisory Service, have initiated on-site inspections of Upbit's systems. Government officials cited similarities between this attack and the 2019 breach, where Lazarus allegedly stole 58 billion won in Ethereum by compromising admin credentials or impersonating administrators according to data. The methods observed in this latest incident— including rapid fund laundering through multiple wallets—align with Lazarus's known tactics according to analysis. "Hackers often show strong tendencies toward boasting," one security expert noted, suggesting the attack may have been timed to coincide with the merger announcement to maximize visibility according to reports.

Upbit has pledged to reimburse all affected users from its own reserves, a move that underscores the exchange's commitment to maintaining trust in the wake of the breach according to reports. The company emphasized that cold wallets—offline storage systems—remained unaffected, and it has since moved remaining assets to cold storage. However, the incident marks Upbit's second major hot wallet breach in six years, raising concerns about the vulnerabilities of internet-connected crypto infrastructure according to analysis.

The attack has reignited discussions about North Korea's reliance on cybercrime to circumvent foreign currency shortages. Lazarus, a hacking unit linked to Pyongyang's General Reconnaissance Information Bureau, has previously targeted global crypto platforms to fund state activities. Onchain data indicates the stolen funds were swiftly converted to USDC and bridged to Ethereum, further obscuring transaction trails according to onchain analysis. South Korea has historically pursued a nuanced approach to North Korea sanctions, with officials recently indicating a potential review of measures if they prove critical to countering Pyongyang's digital threats according to analysis.

The breach occurred amid a pivotal corporate milestone for Upbit. Naver Financial, the fintech arm of South Korea's leading internet company, announced a $10.3 billion merger with Dunamu, signaling a strategic push to integrate crypto assets into its broader financial ecosystem according to reports. The timing has drawn comparisons to the 2019 incident, which also occurred during a period of heightened activity for the exchange. Analysts suggest the attack may have been designed to test the resilience of Upbit's new corporate structure according to analysis.

Regulatory scrutiny of Upbit's security practices is expected to intensify. The Financial Services Commission has mandated that cryptocurrency exchanges comply with the Credit Information Act, a framework that now applies to user transaction data. The Korea Internet and Security Agency has also joined the investigation, reflecting a coordinated effort to address the breach according to reports.