Loading story…
South Korean cryptocurrency exchange Upbit suffered a major security breach resulting in the theft of approximately $30 million in digital assets from its Solana wallet. The attack exploited a vulnerability that allowed private key inferencing, enabling the attackers to transfer various tokens, including official Trump, USD Coin, and Bonk, out of Upbit's wallets. Following the incident, Upbit halted all digital asset transactions, initiated a comprehensive security review, and began restructuring its wallet systems. The company has assured customers that all losses will be covered and that the private key vulnerability has been addressed.
South Korean officials and multiple sources have attributed the attack to the North Korean state-backed Lazarus Group, citing similarities in tactics and laundering methods to previous incidents, including a 2019 breach of Upbit. Investigators believe the hackers impersonated Upbit administrators to facilitate the theft and are actively tracking the stolen funds, attempting to freeze assets before they can be moved further. The breach occurred shortly after Naver's $10 billion acquisition of Dunamu, Upbit's parent company, adding further scrutiny to the incident. Authorities continue to investigate, emphasizing the ongoing threat posed by Lazarus to the cryptocurrency sector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After the incident, Upbit said it remediated the private key vulnerability, started restructuring its security and wallet systems, and pledged through operator Dunamu to cover customer losses. The company said it would ensure member assets were not harmed by the breach.
In response to the theft, Upbit suspended deposits, withdrawals, and other digital asset transactions while transferring assets to a cold wallet and working to freeze the stolen funds. The exchange also began a broader review of its wallet and security systems.
Following the breach, South Korean officials said the attack was suspected to have been carried out by North Korea's Lazarus Group based on the tactics and laundering methods observed. The incident was also compared to a 2019 Upbit hack previously attributed to Lazarus.
On 2025-11-27, South Korean cryptocurrency exchange Upbit suffered a major security breach that resulted in the theft of about $30 million in digital assets from its Solana wallet. Reports said the attack involved administrator impersonation and exploited a weakness that enabled private key inferencing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetherecord.media
Open sourcekoreatimes.co.kr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Upbit, South Korea’s largest cryptocurrency exchange, suffered a significant security breach resulting in the theft of Solana-based tokens. The company reported an unauthorized transfer of assets valued at approximately $30 million, prompting an immediate suspension of all deposit and withdrawal transactions. In response, Upbit moved its remaining assets to a secure cold wallet to prevent further losses and began investigating the incident. The hack was discovered just hours after Naver Corp., the country’s largest search engine, announced a $10 billion acquisition of Upbit’s parent company, Dunamu. While initial reports varied on the total value of stolen assets, the incident highlights ongoing vulnerabilities in the cryptocurrency sector and follows a series of high-profile crypto exchange breaches in recent years. Upbit’s swift response aimed to contain the damage and reassure users amid heightened scrutiny following the acquisition news.
Jun 29, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
Crypto exchange **Bybit** lost about **$1.5 billion** in Ethereum-linked assets after attackers compromised the platform in what has been described as the largest cryptocurrency theft on record. Blockchain investigators at TRM Labs and a subsequent **FBI/IC3** public attribution linked the operation to North Korean threat actors, citing wallet overlaps and tradecraft consistent with earlier DPRK-backed campaigns. Reporting tied the theft to a broader pattern of financially motivated North Korean operations that have previously targeted major crypto platforms and financial institutions. After the theft, the stolen funds were moved at high speed through intermediary wallets, decentralized exchanges, and cross-chain bridges, with a large share ultimately converted into **Bitcoin**. Analysts said the laundering operation showed an evolution in DPRK tactics away from reliance on traditional mixers and toward rapid, high-volume cross-chain obfuscation; later reporting said more than **$1 billion** had been laundered within months. The heist also triggered recovery efforts, including Bybit's **10% bounty** program for frozen or recovered assets, and intensified debate over cryptocurrency oversight and the implications for future U.S. regulation.
Jun 29, 2026