South Korean exchange Upbit has faced one of the largest security incidents in recent years. An overnight hack of a Solana network hot wallet led to the withdrawal of assets worth about $37 million. The exchange immediately froze deposits and withdrawals and began a comprehensive audit of its systems.
A failure that was noticed too late
The problem surfaced early in the morning, at a time when most users were still asleep. Around 4:42 local time, Upbit’s automated systems detected the movement of assets to an external address not related to the exchange’s infrastructure.
An internal alert was triggered, after which the security team blocked asset operations to stop further leakage. By that time, most of the withdrawals had already occurred, and the trail led to the Solana hot wallet that handled the exchange’s daily transactions.
Hot wallets have historically remained the most vulnerable element of exchange infrastructure. They are constantly connected to the network, allowing quick withdrawals, but making them the main target for attacks in the ecosystem.
What exactly the attackers stole
Upbit clarified that the list of stolen assets included both major tokens and small positions of retail users. Among them were Bonk (BONK), Moodeng (MOODENG), Official Trump (TRUMP), Sonic SVM (SONIC), Access Protocol (ACS), Jito (JTO), Solana (SOL), Raydium (RAY), Pudgy Penguin (PENGU), and the stablecoin USDC.
The stolen set demonstrates an important detail: the attackers were not interested in any specific asset. Their goal was maximum liquidity. They took everything that could be withdrawn quickly, without disrupting the system or attracting user attention.
Upbit noted that only the hot wallet was affected. The exchange’s cold storage remained untouched, meaning the reserve structure is fully preserved. In addition, the exchange managed to freeze $8.18 million in Solayer (LAYER) tokens that the attackers had not yet withdrawn.
Users will not lose a single token
Despite the scale of the incident, Upbit immediately stated that all losses would be covered from its own reserves. The company emphasized that clients would not feel any financial consequences from the hack.
While the exchange is auditing its networks, deposits and withdrawals remain blocked. However, trading continues as usual. This allows users to manage their positions within the exchange without disrupting the platform’s market activity.
Full restoration of functionality is expected after the technical audit is completed. Such audits usually take from several hours to several days, depending on the scale of the attack and the complexity of the infrastructure.
Context: historic deal and growing pressure
The situation is unfolding against the backdrop of an important stage for Dunamu, the owner of Upbit. The company recently concluded the largest deal in its history: Naver Financial is acquiring Dunamu as part of a share swap worth 15.1 trillion won, equivalent to about $10.3 billion.
After the merger, the company plans to enter the US market, which has already attracted increased attention from regulators and analysts. Against this backdrop, the hot wallet hack has become a test for Upbit’s reputation—a platform long considered a security benchmark among Asian exchanges.
Why this matters: When preparing to enter foreign markets, any security breach becomes the focus of close attention from investors and regulators.
How Upbit will restore trust
The exchange intends to invest in infrastructure modernization and integrate additional isolation for hot wallets. In the industry, this includes moving to multi-signature systems, automatic anomaly detection, and hybrid storage models.
The incident may also accelerate the exchange’s transition to a more conservative fund distribution model, reducing the share of assets stored in constantly connected environments.
The open question remains: will it be possible to freeze the remaining assets, which may have already fallen into the hands of third parties or ended up in decentralized Solana protocols, where fund recovery is nearly impossible.
Nevertheless, Upbit assured that it continues to work closely with projects, network developers, and law enforcement to minimize the consequences of the attack.
Read more: A sharp drop in USDe yields triggered a capital flight from Ethena
