Upbit Discovers Significant Wallet Vulnerability Amid $30M Theft Investigation

Upbit Finds Critical Wallet Flaw Amid Probe Into $30M Hack

South Korea's leading cryptocurrency exchange, Upbit, has reported the discovery and resolution of a serious vulnerability in its internal wallet system during its investigation into a recent theft of $30 million from the platform.

Key Takeaways:

Upbit identified and fixed a critical wallet flaw that may have exposed private keys, though it has not confirmed if this vulnerability was linked to the $30 million hack.
Approximately 44.5 billion won was stolen, but around 2.3 billion won has already been frozen.
The exchange has suspended trading, transferred funds to cold storage, and committed to fully reimbursing affected users.

On Friday, Upbit’s CEO Oh Kyung-seok announced that their engineers had detected a weakness in the wallet software that could have allowed hackers to derive private keys by analyzing publicly available blockchain information.

However, Upbit has yet to confirm whether this weakness contributed to the theft.

Internal Bug May Have Risked Private Key Exposure

The vulnerability was not related to the underlying blockchains but was found in how Upbit's wallet software created cryptographic signatures.

The exchange warned that this issue might have led to weak or predictable signing data, which could enable skilled attackers to mathematically reconstruct wallet keys through historical transaction analysis.

“We found and resolved the vulnerability while conducting a thorough review of all related networks and wallet systems,” Oh stated. He added that the company implemented emergency response measures and froze all withdrawals and deposits until their systems were secured.

Upbit halted all on-chain activity on November 26 after noticing unusual withdrawals from its hot wallets based on the Solana blockchain.

Tokens involved include SOL, ORCA, RAY, and JUP, according to the exchange. Assets were swiftly moved to cold storage as forensic investigations began.

The losses are estimated to be about 44.5 billion won ($30 million), including approximately 38.6 billion won ($26 million) in customer assets.

The exchange confirmed that roughly 2.3 billion won ($1.5 million) in resources has been frozen through cooperation with external entities.

Upbit stressed that it has not yet established a direct link between the wallet flaw and the theft, noting that the vulnerability was discovered only during an internal audit initiated by the incident.

“No security system is entirely faultless,” Oh remarked, assuring that infrastructure improvements and ongoing transparency will be prioritized as investigations proceed.

The firm confirmed that all affected users will receive full reimbursement from its internal reserves. Deposits and withdrawals will continue to be suspended until a thorough security review is finalized.

Investigation Links Hack to North Korea's Lazarus Group

Authorities in South Korea have initiated an investigation, with initial reports suggesting that the intrusion may be connected to North Korea's Lazarus Group.

This group has been associated with multiple crypto thefts aimed at funding North Korean initiatives amid ongoing foreign currency shortages.

Officials suspect that hackers may have circumvented core systems by impersonating administrators or compromising internal accounts to approve funds withdrawal.

Upbit is actively collaborating with law enforcement and blockchain projects to freeze and recover assets where possible.

This incident occurs at a crucial time for Upbit’s parent organization, Dunamu, which is gearing up for a merger with South Korean internet titan Naver as part of preparations for a potential public listing.