South Korean crypto exchange Upbit says it has secured customer funds after a security breach involving Solana-based assets worth about 54 billion won, or roughly 36.8 million dollars.
The company temporarily halted deposits and withdrawals and launched an emergency inspection after detecting abnormal withdrawals on Nov. 27.
Stay ahead in the crypto world – follow us on X for the latest updates, insights, and trends!🚀
Solana-linked assets moved to unknown wallet
Blockchain tracker Lookonchain first flagged the issue, reporting that about 54 billion won in assets on the Solana network had been transferred from Upbit to unknown wallets.
Screenshots of the movements showed multiple Solana addresses and a series of outbound transfers tied to the exchange’s wallets.
Upbit later confirmed that “some of the Solana network-affiliated assets” were sent to an unspecified external wallet around 04:42 local time on Nov. 27.
The company described the flows as “abnormal withdrawals” and said they triggered its emergency procedures.
The affected assets included a range of Solana ecosystem tokens, such as BONK, JUP, ORCA, RAY, RENDER, SOL itself and stablecoins like USDC.
Upbit did not immediately disclose how the attacker gained access to the funds or whether a specific system vulnerability was involved.
Exchange pauses services for emergency inspection
In a notice signed by CEO Oh Kyung-seok, Upbit said it stopped digital asset deposit and withdrawal services as soon as it detected the abnormal behavior.
The exchange framed the shutdown as a precaution to protect member assets while it carried out a “comprehensive inspection procedure.”
On apologized to users for the disruption and the concern caused by the sudden halt in services. He said engineers and security teams moved quickly to isolate the affected wallets, review internal controls and track the flow of the missing tokens.
During the inspection, Upbit kept trading open but maintained restrictions on deposits and withdrawals for Solana-linked assets.
The company said it would resume normal operations only after confirming that systems were secure and balances matched internal records.
Upbit pledges to absorb losses, protect users
Upbit said it had “immediately identified the scale of digital asset leakage” and stressed that customers would not bear the loss.
The notice stated that the exchange would “cover all of your assets with Upbit’s assets so that there is no damage to your assets.”
The company added that it had already taken “emergency security measures” to prevent further abnormal withdrawals. Those steps included tightening monitoring around Solana-related wallets and moving funds into more secure storage.
By pledging to use its own capital to fill the roughly 36.8 million dollar hole, Upbit aimed to reassure users and head off a broader run on funds.
The exchange said it would continue to update customers on the progress of the investigation and on the timeline for fully restoring deposit and withdrawal services.
Security questions linger after rapid recovery
While Upbit moved quickly to contain the incident and promise compensation, the breach raised fresh questions about hot-wallet risk on major Asian exchanges.
The transfers appeared to come from Upbit-controlled wallets that held Solana ecosystem tokens used for customer balances.
The company did not immediately say whether it had recovered the stolen tokens themselves on-chain or whether the “recovery” referred to internal reimbursement from its own reserves.
It also did not detail whether it had identified the attacker behind the unknown external wallet.
Even so, the exchange framed the episode as a test of its safeguards rather than a failure of its core business.
In its notice, Upbit said it would keep member asset protection as its “top priority” and continue strengthening monitoring so that similar abnormal withdrawals are detected and blocked earlier in the process.
Disclosure:This article does not contain investment advice or recommendations. Every investment and trading move involves risk, and readers should conduct their own research when making a decision.
Kriptoworld.com accepts no liability for any errors in the articles or for any financial loss resulting from incorrect information.
Tatevik Avetisyan is an editor at Kriptoworld who covers emerging crypto trends, blockchain innovation, and altcoin developments. She is passionate about breaking down complex stories for a global audience and making digital finance more accessible.
📅 Published: November 27, 2025 • 🕓 Last updated: November 27, 2025
