Upbit's $36M Hack Meet Korea's Regulators — Awkward First Date 💼

South Korea's Financial Supervisory Service has formally opened a sanctions procedure against Dunamu, operator of the Upbit crypto exchange, over the $36 million exploit disclosed in November 2025, according to a report from Yonhap News. The regulator sent Dunamu an inspection opinion letter, initiating a process that allows the company to respond to findings before the FSS notifies it of any proposed penalties. Cointelegraph has reached out to Dunamu for comment.

The breach began at 4:42 a.m. KST on November 27 and lasted approximately 54 minutes, according to Yonhap. Upbit did not publicly announce the incident until the end of the day, after a merger-related event involving internet firm Naver Financial had concluded. The delay drew criticism from market participants. The FSS said it is reviewing whether Upbit's conduct violated the Virtual Asset User Protection Act, which contains no direct sanctions provisions tied to cyberattacks or computer system hacks. Yonhap reported that South Korean authorities plan to add hacking and system-failure sanctions and compensation rules to the second phase of the Digital Asset Basic Act to close that gap.

Following the incident, Upbit said it froze approximately 2.3 billion won ($1.5 million) of funds and committed to fully reimbursing affected customers from its own balance sheet. The exchange said it overhauled its wallet architecture and migrated all assets from the affected wallets. In December 2025, Upbit said it built an Onchain AI Tracer System designed to automatically follow the movement of stolen funds and support potential recovery efforts. Upbit ranks third in CoinMarketCap's crypto spot exchange rankings, which factor in traffic, liquidity and trading volumes.