Upbit faces sanctions in South Korea after $36M hack

South Korea’s regulator is sanctioning Upbit operator Dunamu after a $32–36M hack, but unclear laws on hacking leave the scope and severity of penalties uncertain.

South Korea’s Financial Supervisory Service has launched formal sanctions proceedings against Dunamu, the operator of crypto exchange Upbit, after a major hack in November 2025. The breach resulted in losses of approximately 44.5 billion won (about $32–36 million), primarily targeting Solana-based assets over a 54-minute period. Regulators are scrutinizing both the security lapse and the timing of Upbit’s public disclosure. The Financial Supervisory Service has sent Dunamu an inspection opinion letter, initiating the sanctions process and allowing the company to respond before penalties are determined. However, South Korea’s Virtual Asset User Protection Act lacks clear provisions for sanctions related to hacking or system failures, making the scope of penalties uncertain. Upbit has since reimbursed affected customers and upgraded its wallet systems. The incident has exposed a legal gap that authorities intend to address in future digital asset regulations.