South Korea Sanctions Upbit Operator Over $36M Hack Delay

Woofun AI reports that the Financial Supervisory Service (FSS) has initiated formal sanctions proceedings against Dunamu, the operator of Upbit, by issuing an inspection opinion letter. This regulatory action targets the exchange’s handling of a significant security incident, marking the beginning of a procedural review where Dunamu must respond to findings before final penalties are determined.

The scrutiny stems from a $36 million exploit that occurred on November 27, 2025, lasting approximately 54 minutes starting at 4:42 a.m. KST. Upbit faced intense criticism for withholding public disclosure until the end of the day, only after concluding a merger-related event with Naver Financial. This delay triggered an investigation into potential violations of the Virtual Asset User Protection Act, which currently lacks specific sanction clauses for cyberattacks or computer system failures.

Structurally, the incident has accelerated legislative reforms, with authorities planning to introduce sanctions and compensation provisions for hacking incidents in the second phase of the Digital Asset Basic Act. Per Woofun AI, the exchange froze approximately 2.3 billion won ($1.5 million) in funds and committed to full reimbursement using its own balance sheet assets. To mitigate future risks, Upbit overhauled its wallet architecture and launched the Onchain AI Tracer System in December 2025 to track stolen assets.

Despite the breach, Upbit maintains its position as the third-ranked crypto spot exchange on CoinMarketCap, based on metrics including traffic and liquidity. Comment was sought from Dunamu regarding the ongoing investigation. This case underscores the urgent need for clearer regulatory frameworks addressing digital asset security failures.