Dunamu / Upbit
Summary
Dunamu is the South Korean fintech company that operates Upbit, the country's dominant cryptocurrency exchange holding approximately 80-90% domestic market share. In November 2025, Upbit suffered its second major hot wallet breach in six years, losing approximately 44.5-54 billion KRW (roughly $30-36 million) in Solana-based assets attributed by South Korean authorities to North Korea's Lazarus Group. South Korea's Financial Supervisory Service formally initiated sanction proceedings against Dunamu on July 19, 2026, focusing in part on the alleged delay in public disclosure of the hack until after a Naver Financial merger event had concluded.
Connected Entities
1 entities · 10 linked investigations- + 1 more
Timeline(11 events)
2019-11-27
Upbit's first major hot wallet breach: approximately 342,000 ETH (roughly 58 billion KRW) stolen. South Korean authorities later attribute the attack to North Korea's Lazarus Group and Andariel.
Digital Watch Observatory / Cryptopolitan2024-07-01
South Korea's Virtual Asset User Protection Act (first phase) enters into force, creating initial regulatory framework for virtual asset service providers.
CoinLaw / Cryptobriefing2025-01-09
South Korea's Financial Intelligence Unit (FIU) issues a preliminary notice of sanctions against Dunamu over AML and KYC compliance violations, including approximately 34,777 KYC failures and transfers with 19 unregistered foreign service providers.
Finance Magnates / Phemex News2025-02-01
FIU imposes sanctions on Dunamu: a 35.2 billion KRW (~$25M) fine, a disciplinary warning to Dunamu's CEO, and a three-month suspension on new customer deposits, withdrawals, and transfers.
AML Intelligence / CoinDesk2025-11-27
Upbit's Solana hot wallet is breached beginning at 4:42 a.m. KST. Attackers drain 44.5-54 billion KRW (~$30-36M) in Solana-based assets over approximately 54 minutes. The incident coincides with a Naver Financial merger-related corporate event. Public disclosure allegedly occurs only after that event concludes.
CoinDesk / The Block / BeInCrypto2025-11-28
South Korean authorities announce suspicion that North Korea's Lazarus Group is responsible for the Upbit hack. Seoul opens a formal investigation. Dunamu states it will fully reimburse affected users.
CoinDesk / Decrypt2025-12-01
FSS Governor Lee Chan-jin states at a press conference that the Virtual Asset User Protection Act does not provide sufficient legal grounds to hold service providers fully accountable for hacking incidents, signaling the regulatory gap that would later complicate sanction proceedings.
CoinLaw / Cryptobriefing2026-02-01
Dunamu recovers approximately 2.6 billion KRW in frozen attacker assets and compensates users for the remaining 38.6 billion KRW loss from its own reserves.
KuCoin News / Cryptobriefing2026-04-01
A court order partially reverses the FIU's February 2025 customer transfer suspension against Dunamu.
Cryptobriefing2026-07-07
BonkDAO suffers a $20 million governance attack via malicious proposal BIP #76. Upbit suspends BONK deposits and withdrawals citing user protection. BONK price falls approximately 9%.
The Block2026-07-19
The FSS formally issues an inspection opinion letter to Dunamu, initiating a multi-stage sanction process over the November 2025 hack and alleged disclosure delay. No penalty has been proposed at this stage.
The Block / Crowdfund InsiderDecision Log
- #1publish⛓ pending7/30/2026, 11:05:25 PMhash: 9Zmxg7PeKafi6FUFoHCz2tQTNhH76jYsD7NrbXjgukQL
22 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/30/2026, 11:05:11 PM
last updated: 7/31/2026, 7:43:21 AM
avoid.net — verified advice for a post-truth world