Loading story…
Upbit, South Korea’s largest cryptocurrency exchange, suffered a significant security breach resulting in the theft of Solana-based tokens. The company reported an unauthorized transfer of assets valued at approximately $30 million, prompting an immediate suspension of all deposit and withdrawal transactions. In response, Upbit moved its remaining assets to a secure cold wallet to prevent further losses and began investigating the incident.
The hack was discovered just hours after Naver Corp., the country’s largest search engine, announced a $10 billion acquisition of Upbit’s parent company, Dunamu. While initial reports varied on the total value of stolen assets, the incident highlights ongoing vulnerabilities in the cryptocurrency sector and follows a series of high-profile crypto exchange breaches in recent years. Upbit’s swift response aimed to contain the damage and reassure users amid heightened scrutiny following the acquisition news.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Following the breach, Upbit stated that customer assets would be fully covered from its own funds. Reports also said the exchange had frozen some of the stolen assets while continuing its investigation.
In response to the hack, Upbit halted deposits and withdrawals and implemented emergency security measures, including transferring assets to cold wallets. The exchange also said it was investigating the incident and working to contain the impact.
Upbit discovered unauthorized transfers of Solana-based assets to an unknown external wallet, with reported losses of about ₩44.5 billion, or roughly $30 million. Multiple reports say the breach was identified hours after the acquisition announcement.
Naver Corp. announced an all-stock deal valued at about $10.27 billion to $10.3 billion to acquire Dunamu, the parent company of South Korean crypto exchange Upbit. The announcement came shortly before the later-reported security incident at Upbit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetomshardware.com
Open sourcesecurityonline.info
Open sourcetechrepublic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean cryptocurrency exchange Upbit suffered a major security breach resulting in the theft of approximately $30 million in digital assets from its Solana wallet. The attack exploited a vulnerability that allowed private key inferencing, enabling the attackers to transfer various tokens, including official Trump, USD Coin, and Bonk, out of Upbit's wallets. Following the incident, Upbit halted all digital asset transactions, initiated a comprehensive security review, and began restructuring its wallet systems. The company has assured customers that all losses will be covered and that the private key vulnerability has been addressed. South Korean officials and multiple sources have attributed the attack to the North Korean state-backed Lazarus Group, citing similarities in tactics and laundering methods to previous incidents, including a 2019 breach of Upbit. Investigators believe the hackers impersonated Upbit administrators to facilitate the theft and are actively tracking the stolen funds, attempting to freeze assets before they can be moved further. The breach occurred shortly after Naver's $10 billion acquisition of Dunamu, Upbit's parent company, adding further scrutiny to the incident. Authorities continue to investigate, emphasizing the ongoing threat posed by Lazarus to the cryptocurrency sector.
Jun 29, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
**Step Finance**, a Solana-based DeFi platform and analytics dashboard, reported a breach in which attackers **compromised devices belonging to company executives** and used that access to drain multiple **treasury wallets**. The incident was detected on **January 31**, with the threat actor described as leveraging a **“well-known attack vector,”** though Step Finance did not publicly disclose the specific technique or attribution. Initial third-party estimates from blockchain analytics firm **CertiK** put the theft at **261,854 SOL (~$28.9M)**, but Step Finance’s internal investigation later assessed total losses at **~$40M**. Step Finance said it has recovered **~$3.7M in Remora assets** and **~$1M in other positions** through partner coordination and **Token22 protections**, temporarily halted some operations to reinforce security, and stated that **Remora Markets is isolated** from the incident with **rTokens remaining 1:1 backed**; users were also advised **not to engage with the `STEP` token** until the investigation concludes.
Jun 29, 2026