South Korean Authorities Report Binance's Limited Action on Upbit Hack Funds

Korean authorities have expressed concerns that Binance only froze a fraction of the cryptocurrency stolen in the recent Upbit hack, despite urgent requests to halt the movement of these illicit funds. This article explores the extent of Binance's actions, the complexities involved in the laundering of funds, and the implications for cryptocurrency security.

Key Takeaways

Binance only managed to freeze 17% of the stolen Upbit funds, despite an urgent request from police and the exchange.
The hacking group used intricate laundering tactics across various blockchain networks, with most funds ending up in Binance wallets.
Experts argue for quicker and better-coordinated freezing mechanisms to minimize losses in future hacking incidents.

According to local news reports, investigators revealed that Binance froze only 17% of the flagged assets linked to the Upbit hack.

Security analysts tracking the breach noted that the hacking group employed a sophisticated laundering strategy on the morning of November 27, dispersing the stolen assets across more than a thousand wallets.

Korean Authorities Claim Binance Froze Only a Fraction of Upbit Hack Funds

Binance's Limited Action on Stolen Upbit Funds

The attackers divided the stolen funds into smaller amounts, moving them through multiple blockchain networks and utilizing token bridges and swaps to disguise their tracks. Authorities indicated that the majority of the laundered assets eventually reached service wallets on Binance.

Upbit and law enforcement had urgently requested a freeze on approximately 470 million won (around $370,000) worth of Solana believed to have landed on Binance. However, Binance only managed to freeze 80 million won (about $75,000), citing the need for additional verification before taking more extensive action.

This freeze was confirmed around midnight on the day of the incident, approximately 15 hours after the initial request.

When asked by Korean broadcaster KBS about the limitations of the freeze and the delay, Binance opted not to comment on the specifics, referring to its policy regarding ongoing investigations. The exchange stated that it is “continuing to cooperate with the relevant authorities and partners according to relevant procedures.”

This response has not satisfied experts in South Korea. Cho Jae-woo, director of the Blockchain Research Institute at Hansung University, emphasized the importance of a quick initial freeze to mitigate losses. “To prevent damage from hacking, swift intervention is crucial, but exchanges often hesitate due to fears of litigation risks,” he said.

He suggested that the industry should explore establishing a global emergency hotline among exchanges or a coordinated authority capable of implementing immediate freezes during crises.

Investigators noted that most of the stolen assets have since been converted from Solana to Ethereum, presumably to enhance liquidity, given Ethereum’s robust markets.

Upbit's Response to the Hack

Following the hack, Upbit announced plans to move nearly all customer assets to cold storage. The exchange was compromised for approximately 44.5 billion won (around $30 million) from its Solana hot wallet, marking a significant security response from a major trading platform.

The operator, Dunamu, stated that Upbit will increase its cold wallet ratio to 99% and reduce hot wallet exposure to nearly zero, well above South Korea’s legal requirement of 80% of user funds being stored offline.

As of the end of October, Upbit already had 98.33% of its assets in cold storage, the highest percentage among domestic exchanges, and has expedited its security measures following the breach.

In conjunction with these developments, South Korean authorities have initiated an investigation, with local reports suggesting that early assessments may link the hack to North Korea’s Lazarus Group.