South Korea's Financial Supervisory Service (FSS) has begun a sanctions process against Dunamu, operator of the Upbit crypto exchange, following a November 2025 hack of ~$30 million. The action proceeds despite the current Virtual Asset User Protection Act lacking direct provisions for penalizing exchanges for hacks, a regulatory gap authorities plan to close with future legislation. The process unfolds as a merger between Dunamu and Naver Financial remains pending.
Upbit hack incident
- ▪As of July 2026, Dunamu has frozen 2.6 billion won ($1.7 million) of the stolen funds and is working to recover them
- ▪The Upbit exchange was hacked for 44.5 billion won (about $30 million) in Solana-based assets on November 27, 2025
- ▪The funds were drained to an external wallet over approximately 54 minutes, starting at 4:42 a.m. local time
- ▪Dunamu used Upbit's own reserves to cover 38.6 billion won ($26 million) in affected customer assets
- ▪South Korean authorities suspect North Korea's Lazarus Group was behind the theft, though this has not been publicly confirmed
FSS sanction procedures
- ▪Final sanctions will be decided by the FSS's Sanctions Review Committee, the Securities and Futures Commission, and the Financial Services Commission
- ▪The FSS initiated the process by sending Dunamu an inspection report, which marks the formal start of the sanctions procedure
- ▪South Korea's Financial Supervisory Service (FSS) has begun sanction procedures against Dunamu, the operator of crypto exchange Upbit
Virtual Asset User Protection Act
- ▪The FSS is examining whether the incident violated the Virtual Asset User Protection Act
- ▪Authorities plan to add rules on sanctions and compensation for hacking incidents in the Digital Asset Basic Act, the next phase of crypto legislation
- ▪The Virtual Asset User Protection Act does not contain direct provisions for sanctioning exchanges over hacks or IT failures
Dunamu-Naver merger impact
- ▪Upbit was criticized for delaying its hack announcement until after a merger-related event with Naver Financial had concluded on the same day
- ▪The sanction process is occurring while Dunamu's stock-swap merger with Naver Financial, pushed back to December 31, is still pending
Bithumb inspection
- ▪The Bithumb probe examined the exchange's internal controls and risk management, and sanction procedures are planned to begin after legal reviews
- ▪The FSS has also concluded a separate inspection of rival exchange Bithumb over an incident involving misallocated bitcoin
Story comments
Loading comments…