Upbit Announces December 1 Service Restoration Following Major Security Breach
South Korea’s leading cryptocurrency exchange Upbit has confirmed it will resume digital asset deposits and withdrawals on December 1 at 1:00 PM KST, following a sophisticated $37 million security breach that targeted Solana-based assets. The announcement comes after extensive security upgrades and system maintenance implemented in response to the November 27 hack.
Security Measures and New Deposit Requirements
In a significant security overhaul, Upbit has invalidated all existing deposit addresses and requires users to generate new addresses before making any deposits. The exchange emphasized that using old deposit addresses could result in processing delays and potential security risks.
Critical User Instructions
Upbit has instructed users to delete any existing Upbit deposit addresses registered in personal wallets or other exchanges to prevent future misuse. The exchange warned that deposits made during the suspension period will be processed sequentially once services resume, though processing may require additional time due to enhanced security protocols.
Hack Details and Suspected Perpetrators
The security breach occurred on November 27, 2025, when hackers successfully stole approximately 44.5 billion KRW ($30-36 million USD) from Upbit’s hot wallets. Unlike the exchange’s 2019 attack that focused on Ethereum, this incident specifically targeted Solana ecosystem tokens including SOL, USDC, and Bonk.
North Korean Connection Suspected
Security analysts suspect North Korea’s Lazarus Group orchestrated the sophisticated attack, marking another chapter in the notorious hacking collective’s cryptocurrency exchange targeting operations. The group has been responsible for several high-profile crypto thefts in recent years.
Recovery Efforts and User Protection Measures
Upbit has demonstrated strong commitment to user protection by pledging 100% coverage of all losses from corporate reserves. The exchange immediately halted all deposit and withdrawal services upon detecting the unauthorized transfers, highlighting the operational risks and compliance costs associated with such incidents.
Asset Recovery Success
In a notable recovery effort, Upbit successfully collaborated with token foundations to freeze approximately $8.18 million worth of specific tokens like LAYER, effectively rendering them worthless to the attackers. The frozen assets represent roughly 22% of the total stolen amount, showcasing the importance of industry cooperation in combating cryptocurrency theft.
The phased resumption of services will begin with network digital assets that have completed comprehensive wallet system inspections and security confirmations. Staking requests and NFT deposits supported by resumed networks will be processed after service stability verification, ensuring a secure and measured return to full operations.
