Upbit, South Korea’s largest virtual currency exchange, announced that it will gradually resume deposit and withdrawal services from 1:00 pm (KST) on December 1, 2025.
Korean exchanges will resume operations in a divided manner. Upbit will begin a gradual resumption of deposits and withdrawals starting December 1st at 1pm (KST) following the $36.8 million Solana network hack.
Upbit suspends service due to North Korea-related hacking
The platform initially suspended all services due to a security breach on November 27 that resulted in the unauthorized withdrawal of approximately 54 billion Korean won ($36.8 million) in SOL, USDC, and more than 20 other Solana-based assets, including BONK, JUP, RAY, ORCA, RENDER, PYTH, and TRUMP.
The exchange detected abnormal withdrawals of various virtual currencies on the Solana network at around 4:42 a.m. Korean Standard Time on November 27th.
The hack occurred a day after Naver Financial announced it would acquire Upbit’s parent company Dunum for 15.1 trillion won ($10.3 billion) in an all-stock merger expected to be completed in June 2026.
Once the attack was detected, Upbit immediately suspended all deposits and withdrawals across the platform and moved remaining assets to cold storage to prevent further losses. The exchange successfully froze $8.18 million worth of LAYER tokens and continues to work with projects and authorities to freeze further stolen funds.
Upbit CEO Oh Kyung-seok said the exchange would cover the entire amount with its own reserves to ensure customers do not suffer personal losses.
Upbit has been hacked before, with 342,000 ETH stolen by attackers in 2019. South Korean authorities have expressed suspicions that both the 2019 attack and the recent hack were carried out by the Lazarus Group, a North Korean state-sponsored hacking organization.
South Korean government officials believe the hackers either compromised the administrator’s account or masqueraded as the administrator and authorized the transfer. Blockchain analysis showed that the hacker’s wallet exchanged Solana for USDC and bridged the funds to the Ethereum network, which appeared to be an attempt to cover its tracks.
According to blockchain security platform Immunefi, Lazarus lost more than $300 million overall in cryptocurrency hacking incidents in 2023, representing 17.6% of its total losses that year.
Service will be restored gradually
Upbit plans to resume deposit and withdrawal services from December 1, 2025, after the service was suspended due to a security breach in November.
Upbit’s initial recovery efforts will target network assets such as Akash Network’s AKT and Ethereum ecosystem tokens such as 1INCH, AAVE, and ADT.
All assets will be migrated to the new deposit address, so users should check the updated address and monitor their funding status. The exchange has not disclosed when all cryptocurrency deposit and withdrawal services will be fully restored, but has indicated that services will be gradually resumed as the safety verification of each asset is completed.
Users who already had funds on the platform could trade on the exchange as usual during the suspension period, but users were unable to transfer funds to or from the exchange during the same period.
The Financial Supervisory Service (FSS) has begun an on-site inspection of Upbit, which is expected to continue until December 5th.
