Analysis of Upbit's Recent Security Breach
Technical analysis of the latest attack on Upbit, one of South Korea's largest cryptocurrency exchanges, shows that the incident points to a much more complex picture than an ordinary hacking case.
Cybersecurity firm GoPlus, in a report detailing the attack, noted that the hot wallet breach involved vulnerabilities in both key management and internal network security. While the company confirmed that cold wallets remained secure, the nature of the attack suggests the possibility of an advanced and long-term breach.
Striking Similarities and Deliberate Timing
One of the striking aspects of the incident is its “anniversary attack.” The date coincides with the $50 million hack that Upbit suffered in 2019. Furthermore, the attack was launched just hours after the major merger announcement between Dunamu and Naver, suggesting deliberate timing.
Lazarus Group Tactics and Money Laundering Techniques
GoPlus also stated that the attack was consistent with typical Lazarus Group methods. The speed, operational methods, and symbolic timing are consistent with known tactics of North Korea-linked Advanced Persistent Threat (APT) groups. The methods used to launder the stolen assets were also noteworthy: the attackers reportedly used multiple decentralized exchanges (DEXs) to complicate the trail, and 2,200 SOL was transferred to Binance. These techniques suggest a professional money laundering process designed to circumvent regulations.
Upbit previously announced that approximately 54 billion won worth of assets were stolen from the Solana network in the attack. South Korean authorities strongly suspect that the North Korean hacker group Lazarus may be behind the attack.