Upbit reported a major security incident after irregular activity drained approximately $36 million in assets from its Solana hot wallet. The exchange detected the issue on Thursday and quickly froze activity linked to the compromised address. It confirmed that the assets were moved to an unknown wallet at around 04:42 local time on November 27. The transaction involved about 54 billion KRW worth of digital assets.
Investigators began tracing the outgoing transfers as the exchange paused services on affected Solana-based assets. Upbit said its internal systems flagged the abnormal withdrawals immediately after the breach occurred. The exchange stated that users would not absorb any losses because it plans to cover the full amount using its own assets.
Affected tokens include Bonk, Moodeng, Official Trump, Sonic SVM, Access Protocol, Jito, Solana, Raydium, Pudgy Penguin, and Circle’s USDC. Upbit also confirmed that it successfully froze a portion of Solayer after coordinating with relevant project teams.
The breach arrived at a moment when users across the industry continue to question the strength of platform protections. Security failures often weaken user confidence and discourage engagement. Upbit acknowledged this risk while outlining steps to restore stability.
The exchange declared that it would compensate all afflicted customers in full. It said this decision is a commitment to stop any impact on user balances. This approach is in line with common damage-control practices that give priority to user protection.
Upbit also initiated an emergency review of all wallet systems and network layers. It transferred all remaining assets from hot wallets to cold storage to block further irregular withdrawals. This step formed part of a broader containment plan as the investigation progressed.
Regulators and law enforcement are also involved as investigators map the flow of stolen funds. Cooperation with authorities often helps exchanges recover assets and strengthen user confidence. The exchange continues to track the compromised funds on-chain as coordination efforts expand.
The breach coincided with a major corporate transition for Dunamu, Upbit’s parent company. Dunamu is preparing for absorption into Naver Financial through a $10.3 billion stock-swap agreement. This shift marks one of the group’s largest structural changes in years.
Upbit said its internal teams began full security audits minutes after detecting the abnormal transfers. These reviews cover infrastructure, monitoring systems, and procedures linked to all Solana network assets. The goal is to ensure full network stability before resuming normal operations.
User deposits and withdrawals for affected networks will reopen only after the systemwide checks are complete. Upbit said transparency remains essential as it continues providing updates during the investigation. This approach is expected to guide users through the recovery phase.
As the industry observes the situation, one question emerges: Can exchanges reinforce trust even after large-scale breaches?
Upbit continues coordinating with projects and investigators as containment measures expand and reimbursement plans progress.
Upbit confirmed a $36 million Solana hot-wallet breach and moved assets to cold storage while it started systemwide audits. Investigators are tracing the stolen funds as the exchange prepares full user reimbursement. Users should monitor official updates as security checks continue across affected networks.