Upbit, South Korea’s largest crypto exchange, has confirmed a major security breach leading to the theft of nearly 44.5 billion won, or roughly $30 million in digital assets. According to early investigations, the attack is suspected to be tied to the North Korea–linked Lazarus Group, raising new concerns about state-sponsored cyber threats targeting major exchanges.
The incident occurred due to unauthorized access to an administrator account, not a server-level hack. This distinction highlights persistent vulnerabilities in internal security frameworks across centralized exchanges.
Lazarus Group Suspected in $30M Upbit Theft
Upbit revealed that more than 20 different token types were stolen, including Solana (SOL), USDC, and several memecoins. Among them, Solana formed the largest portion of the loss.
Upbit CEO Oh Kyung-seok, who leads Dunamu, the parent company, reassured users that all losses will be fully covered. He stated:
Upbit will cover the entire amount to ensure that no damage is incurred to your assets.
Authorities in South Korea, along with cybersecurity agencies, have initiated a formal investigation. With past operations tied to the Lazarus Group, officials believe this attack may be part of the group’s continuous targeting of crypto infrastructure for financial gain.
Exchange Response: Compensation and Security Reinforcement
Following the breach, Upbit has temporarily tightened withdrawal and administrative controls. The exchange has also launched enhanced audits on its internal security systems, particularly on privileged access permissions.
Current market data paints a challenging picture. Solana (SOL) trades at $139.15, with a -3.20% drop in 24 hours and a -28.53% decline over the last 30 days. The stolen tokens’ volatility adds complexity to valuation and recovery processes.
Industry Impact: Rising Threats and Regulatory Pressure
Cybersecurity analysts warn that centralized exchanges remain prime targets, especially for well-funded groups like Lazarus. Experts expect increased regulatory scrutiny, with stronger compliance requirements around admin-level authentication and internal audits.
A recent analysis suggests that future exchange approvals may require stricter cybersecurity certifications as global threats continue to escalate.
As the investigation widens, Upbit aims to restore full trust by compensating users and strengthening system protections — a crucial step during a period of heightened digital asset risk.