Upbit Halts Withdrawals After $37M Exploit on its Solana Network

Highlights:

• Upbit has confirmed that its Solana network was compromised in the early hours of today. 
• The hackers targeted Solana-based assets, resulting in losses valued at approximately $36.89 million. 
• The trading platform is investigating the incident and has also taken major steps to prevent recurrence.

South Korea’s largest trading platform, Upbit, was the target of a security breach on its Solana (SOL) blockchain, resulting in losses worth 54 billion Korean won ($36.89 million). The exchange confirmed the compromise in an official statement in the early hours of November 27, adding that it has temporarily halted withdrawals and deposits on all affected assets.

Upbit Launches Investigations, Reveals Findings

According to the trading platform’s statement, Dunamu, Upbit’s parent company, conducted an emergency check on its digital asset deposit and withdrawal services after detecting abnormal withdrawals on the Solana network around 4:42 a.m. on November 27. The investigations revealed unauthorized transfers to an unknown external wallet.

The affected Solana tokens include MOODENG, ORCA, PENGU, PYTH, RAY, RENDER, SOL, 2Z, ACS, SONIC, SOON, TRUMP, USDC, BONK, DOOD, DRIFT, HUMA, IO, JTO, JUP, LAYER, ME, MEW, and W. Beyond halting withdrawals and deposits, Upbit launched a comprehensive internal review of both the compromised network and its wallet systems.

Upbit(@Official_Upbit) has been hacked — 54B KRW (~36.8M USD) in assets on #Solana have been transferred to unknown wallets.https://t.co/plbmBz2G4Nhttps://t.co/YOHoqDVfqa pic.twitter.com/DM5BxSTtXA

— Lookonchain (@lookonchain) November 27, 2025

Upbit Takes Proactive Steps, Including Halting Services to Secure Remaining Assets

To prevent further losses, Upbit moved all remaining assets to cold wallets. Also, the exchange froze some assets on-chain, including approximately 12 billion Korean won ($8.2 million) worth of Solayer. Upbit noted that it is still tracking the remaining assets and is working with project teams and other related groups to freeze more assets if possible. The trading platform added that it is willing to collaborate with law enforcement agencies to aid in recovering the stolen assets.

Notably, a comprehensive safety review of Upbit’s withdrawal and deposit system will be conducted. This will include Solana-based assets and other digital assets on the trading platform. Upbit noted that services will resume in a stepwise manner once the exchange’s assets are confirmed safe. 

Upbit assured that affected users will not lose money. The exchange has already confirmed the extent of the loss and will refund victims with the company’s funds. The trading platform also encouraged individuals who may have useful information about the abnormal withdrawals to contact Upbit’s customer support.

The exchange’s Chief Executive Officer (CEO), Oh Kyung-seok, issued a public apology, noting that the situation caused real concern and that the company takes full responsibility. He added that the trading platform will strengthen its security network and continue to prioritize user assets’ security.

Upbit Suffers ~$38.5M Abnormal Outflow on Solana Network

Upbit issued an announcement today at 12:33 KST (UTC+9) stating that an abnormal outflow of assets worth approximately 54 billion KRW (~$38.57m) occurred on the Solana network at approximately 04:42 KST (UTC+9) on November…

— Wu Blockchain (@WuBlockchain) November 27, 2025

Crypto Hack Incidents Continue to Generate Concerns

On November 6, Crypto2Community reported that Australia has imposed heavy sanctions on many North Korean hacker groups accused of stealing digital assets worth billions to fund illegal weapons projects. The sanction targeted top cyber and crypto scam groups, including the notorious Lazarus Group. 

Australia’s Foreign Minister Penny Wong said the move was part of the nation’s efforts to reduce North Korea’s access to illegal funding sources. According to the Foreign Ministry, North Korean hackers were responsible for at least $1.9 billion in crypto theft in 2024. 

On November 3, the Decentralized Finance (DeFi) platform confirmed that hackers stole $129 million from its v2 pools. The attackers targeted Ethereum, Berachain, Polygon, Optimism, Base, and Sonic networks, and stole assets like WETH, osETH, rsETH, wsETH, and sfrxETH.