South Korea begins sanctions process against Dunamu over $30 million Upbit hack

Jul 19, 2026

South Korea's Financial Supervisory Service (FSS) has begun a sanctions process against Dunamu, operator of the Upbit crypto exchange, following a November 2025 hack of ~$30 million. The action proceeds despite the current Virtual Asset User Protection Act lacking direct provisions for penalizing exchanges for hacks, a regulatory gap authorities plan to close with future legislation. The process unfolds as a merger between Dunamu and Naver Financial remains pending.

Upbit hack incident

▪As of July 2026, Dunamu has frozen 2.6 billion won ($1.7 million) of the stolen funds and is working to recover them.
▪The Upbit exchange was hacked for 44.5 billion won (about $30 million) in Solana-based assets on November 27, 2025.
▪The funds were drained to an external wallet over approximately 54 minutes, starting at 4:42 a.m. local time.
▪Dunamu used Upbit's own reserves to cover 38.6 billion won ($26 million) in affected customer assets.
▪South Korean authorities suspect North Korea's Lazarus Group was behind the theft, though this has not been publicly confirmed.

FSS sanction procedures

▪Final sanctions will be decided by the FSS's Sanctions Review Committee, the Securities and Futures Commission, and the Financial Services Commission.
▪The FSS initiated the process by sending Dunamu an inspection report, which marks the formal start of the sanctions procedure.
▪South Korea's Financial Supervisory Service (FSS) has begun sanction procedures against Dunamu, the operator of crypto exchange Upbit.

Virtual Asset User Protection Act

▪The FSS is examining whether the incident violated the Virtual Asset User Protection Act.
▪Authorities plan to add rules on sanctions and compensation for hacking incidents in the Digital Asset Basic Act, the next phase of crypto legislation.
▪The Virtual Asset User Protection Act does not contain direct provisions for sanctioning exchanges over hacks or IT failures.

Dunamu-Naver merger impact

▪Upbit was criticized for delaying its hack announcement until after a merger-related event with Naver Financial had concluded on the same day.
▪The sanction process is occurring while Dunamu's stock-swap merger with Naver Financial, pushed back to December 31, is still pending.

Bithumb inspection

▪The Bithumb probe examined the exchange's internal controls and risk management, and sanction procedures are planned to begin after legal reviews.
▪The FSS has also concluded a separate inspection of rival exchange Bithumb over an incident involving misallocated bitcoin.