South Korean exchange Upbit plans to restart deposits and withdrawals on December 1 following a security incident that froze activity across its platform. The company aims to restore operations in phases as it completes security checks on each supported network.
The resumption comes four days after a significant breach involving Solana-based assets worth nearly $37 million. The exchange says users will regain access to their funds gradually as deposit systems migrate to new addresses.
Exchange Responds to Large-Scale Hack Linked to North Korea
The breach occurred on November 27 when Upbit detected suspicious withdrawals on the Solana network. The incident involved SOL, USDC, and more than 20 other Solana tokens.
Investigators believe the attackers compromised administrator privileges to authorize the transfers. South Korean officials now suspect the Lazarus Group, which has been linked to multiple regional cyber intrusions.
Upbit halted all deposits and withdrawals immediately and moved remaining assets to cold storage. The platform managed to freeze more than $8 million in LAYER tokens during the early response. CEO Oh Kyung-seok confirmed that the exchange will cover the entire loss using its own reserves, ensuring customers remain protected.
The incident surfaced one day after Naver Financial announced a proposed $10.3 billion acquisition of Dunamu, Upbit’s parent company. The deal is expected to close in mid-2026.
Analysts say the hack adds pressure on the firm to demonstrate stronger oversight as the merger process advances. Moreover, Lazarus-linked attacks continue to rise. Blockchain security platform Immunefi attributes more than $300 million in 2023 losses to the group.
Gradual Restoration and New Security Procedures
Upbit will resume service in steps, starting with networks such as Akash and Ethereum-based tokens like AAVE and 1INCH. Every asset will shift to a new deposit address, and users must confirm these updates before transferring funds.
The company has not announced a date for complete restoration across all cryptocurrencies. It says each asset will return only after completing verification checks.
Trading remained available throughout the suspension. However, users could not move funds in or out of the platform. The Financial Supervisory Service launched an on-site review that will continue until December 5. Additionally, market observers expect more regulatory pressure as authorities push for stronger security standards across local exchanges.