Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Global Financial Service Disruptions

Upbit

crypto exchange · KR · East Asia · Dunamu Inc.

Confirmed cyberStatus: unknownTier 1Severity 4 of 5Evidence confidence: highAnalyst-verified

South Korea's largest exchange Upbit detected an unauthorized transfer of about 44.5B KRW in Solana-network assets at 04:42 KST on 27 Nov 2025 and suspended all crypto deposits and withdrawals. It reported to KISA and the FSS and promised full compensation.

First disruption
Nov 26 19:42 UTC
First public signal
Nov 27 (Upbit notice suspending Solana network deposits and withdrawals)
Acknowledged
Nov 27
Restored
not yet
Duration
not established
DFX first recorded
Nov 5 14:58 UTC

What was restricted

withdrawalsdepositsScope: institution wide

Solana-network deposits and withdrawals suspended first, then all virtual asset deposits and withdrawals from 08:55 KST; trading continued; Upbit pledged full compensation from own assets.

Financial impact: 44.5B KRW (about 30.4M to 37M USD), revised down from 54B KRW (company figure).

Cause, kept in separate layers

What the institution said
Abnormal (unauthorized) transfer of Solana-network assets from a hot wallet to an external address
DFX classification
Confirmed cyber (cyber: confirmed)
Analytical hypothesis (not established)
Korean media and analysts suspected DPRK Lazarus Group; not confirmed in retrieved sources.
Conflicting reports
Loss stated as 30M to 38.5M USD. original_text is a paraphrased Korean rendering of the 08:55 suspension reported in English sources, not a verbatim quote.

Evidence