South Korean authorities suspect North Korea’s Lazarus Group is behind the attack, which mirrors methods used in Upbit’s 2019 hack.
South Korea’s largest cryptocurrency exchange, Upbit, announced that it will begin a phased restart of its deposit and withdrawal services starting December 1, 2025, at 1 PM KST.
The South Korean exchange will now restart operations in installments. Upbit will begin a phased resumption of deposits and withdrawals on December 1 at 1 PM KST following a $36.8 million Solana network hack.
Upbit suspended services after a North Korea-linked hack
The platform initially suspended all of its services due to a security breach on November 27 that resulted in the unauthorized withdrawal of approximately 54 billion Korean won ($36.8 million) in SOL, USDC, and more than 20 other Solana-based assets, such as BONK, JUP, RAY, ORCA, RENDER, PYTH, and TRUMP.
The exchange detected abnormal withdrawals of various cryptocurrencies on the Solana network at approximately 4:42 AM Korean Standard Time on November 27.
The hack occurred one day after Naver Financial announced a 15.1 trillion won ($10.3 billion) acquisition of Dunamu, Upbit’s parent company, in an all-stock merger expected to be completed in June 2026.
Once the attack was detected, Upbit immediately suspended all deposits and withdrawals across its platform and moved remaining assets to cold storage to prevent further losses. The exchange successfully froze $8.18 million worth of LAYER tokens and continues working with projects and authorities to freeze additional stolen funds.
Upbit’s CEO, Oh Kyung-seok, said that the exchange would cover the entire amount using its own reserves, ensuring no customer would experience personal losses.
Upbit has been hacked before, in 2019 when the attackers made away with 342,000 ETH. South Korean authorities have indicated they suspect that both the 2019 attack and the most recent hack were carried out by the Lazarus Group, a North Korean state-sponsored hacking organization.
South Korean government officials believe that the hackers compromised administrator accounts or impersonated administrators to authorize the transfers. Blockchain analysis shows that the hacker’s wallet swapped Solana for USDC and then bridged funds to the Ethereum network, in what seemed like an attempt to hide the trail.
According to blockchain security platform Immunefi, Lazarus was responsible for over $300 million in losses across crypto hacking incidents in 2023, representing 17.6% of the year’s total losses.
Services will be restored in phases
Upbit is set to resume its deposit and withdrawal services starting December 1, 2025 following a November security breach that led to the suspension of services.
Upbit’s initial restoration efforts will target network assets like Akash Network’s AKT and Ethereum ecosystem tokens such as 1INCH, AAVE, and ADT.
Users will need to verify updated addresses and monitor their funding status because every asset will migrate to a new deposit address. The exchange has not provided a timeline for when all cryptocurrencies will have their deposit and withdrawal services fully restored, but it has indicated that services will resume gradually as each asset completes its security verification.
Users who already had funds on the platform have been able to trade on the exchange as normal throughout the suspension period, but users were unable to transfer funds into or from the exchange during that same period.
The Financial Supervisory Service (FSS) has launched an on-site inspection of Upbit, and the review is expected to continue until December 5.
Sign up to Bybit and start trading with $30,050 in welcome gifts
