South Korea’s Upbit Reports $36 Million Loss in Solana Hot-Wallet Breach

In short

Upbit stated irregular transfers on the Solana community drained about $36 million throughout a number of tokens, together with BONK, JTO, SONIC, and USDC.
The alternate moved remaining funds offline and is coordinating on-chain freezes with issuers after securing a portion of Solayer tokens.
The CEO of Dunamu, Upbit’s father or mother, stated the alternate will totally reimburse prospects.

South Korea’s largest crypto alternate, Upbit, disclosed a safety incident involving belongings on the Solana community on Thursday, reporting losses of roughly $36 million because the platform moved to comprise the breach.

The alternate stated it detected irregular withdrawals linked to a compromised hot-wallet tackle, prompting it to halt some providers whereas investigators traced the movement of funds.

“At round 04:42 on 2025-11-27, Upbit confirmed {that a} portion of Solana community belongings (roughly 54 billion KRW value) had been transferred to a pockets tackle not designated internally (an unknown exterior pockets),” a tough translation of Dunamu CEO Oh Kyung-seok’s public notice reads.

Affected belongings embrace meme cash corresponding to Bonk (BONK), Moodeng (MOODENG), Official Trump (TRUMP), and decentralized finance tokens corresponding to Sonic SVM (SONIC), Entry Protocol (ACS), Jito (JTO), Solana (SOL), and Raydium (RAY), amongst different tokens corresponding to Pudgy Penguin (PENGU). The record additionally consists of Circle’s USD Coin (USDC).

“The size of the loss brought on by the irregular withdrawals was recognized internally instantly upon affirmation,” Oh stated, including that Upbit will “totally compensate your entire quantity with its personal belongings in order that no impression happens to members’ belongings.”

Upbit stated it has initiated an emergency safety overview of all associated networks and pockets methods instantly after detecting the irregular transfers.

Per Oh’s discover, the alternate moved all remaining belongings into chilly storage to stop further irregular withdrawals, and it’s coordinating on-chain freeze makes an attempt with related initiatives after efficiently freezing a portion of Solayer (LAYER).

Upbit added that broader deposit and withdrawal providers will resume solely after systemwide safety checks are accomplished.

The suspected hack comes as Dunamu, Upbit’s father or mother firm, has been navigating one among its most consequential company transitions in years, with the agency set to be absorbed into Naver Monetary below a $10.3 billion stock-swap agreement.

Decrypt reached out to Dunamu for remark. It is a growing story.