Update on Upbit Hack: Authorities Connect Breach to North Korean Hackers

South Korea’s largest cryptocurrency exchange, Upbit, is under investigation by regulators following a massive hack that resulted in the unauthorized withdrawal of around $36.9 million in assets from the Solana (SOL) network. This breach affected more than 20 different tokens, prompting Upbit to freeze assets on its platform while the inquiry continues.

Key Takeaways

Upbit has suffered a major hack leading to a loss of approximately $36.9 million on the Solana network.
Authorities are investigating ties between the breach and the North Korean Lazarus Group, which has been linked to other significant crypto thefts.
Upbit has suspended all deposits and withdrawals, frozen affected funds, and moved remaining assets to cold storage.
The exchange is committed to reimbursing affected customers and is working with authorities to resolve the situation.

Upbit

Investigation Links Lazarus Group to Upbit Hack

Authorities are currently looking into the possible involvement of North Korea in this cyber attack. Reports indicate that a group connected to North Korea’s intelligence agency, known as the Lazarus Group, may be behind the hack, which Upbit has labeled an “abnormal withdrawal.”

The Lazarus Group has been tied to several high-profile crypto thefts in recent years. The FBI has classified North Korean cyber operations as among the most sophisticated and ongoing threats they face. Interestingly, this recent attack took place just days before the sixth anniversary of another significant breach, in which Upbit lost 342,000 Ethereum (ETH) to North Korean hackers.

An unnamed government official noted that the recent hack shares similarities with a 2019 incident in which around 58 billion won in cryptocurrencies was stolen, also attributed to the Lazarus Group. In response to this cyber incident, the South Korean National Police Agency has begun an investigation, although officials have not commented further on the matter. Upbit’s operator, Dunamu, has confirmed that a comprehensive investigation into the cause and scope of the asset outflow is ongoing.

Security Measures Implemented by Upbit

Oh Kyung-seok, CEO of Upbit, stated that upon detecting abnormal withdrawal activities, the exchange quickly suspended all deposit and withdrawal services. “We are carrying out a thorough inspection, focusing on safeguarding member assets,” he communicated to users. Following the identification of the unauthorized transactions, Upbit has taken measures to freeze the impacted funds wherever feasible.

To deter any additional unauthorized transfers, Upbit has transferred all remaining assets to cold storage, creating “a secure environment for funds.” The exchange is also collaborating with relevant project teams to freeze assets on-chain and has already managed to block some of the stolen funds related to the cryptocurrency Solayer (LAYER). Upbit has informed users that deposits and withdrawals will only resume once complete security evaluations are finalized.

Dunamu has pledged to reimburse customers for any losses incurred using business funds, reinforcing its commitment to user protection. Moving forward, it will be important to see what additional information may emerge from the authorities in the coming days, along with potential reimbursement timelines for those affected.

Upbit
The daily chart shows BTC’s price consolidation above $90,000. Source: BTCUSDT on TradingView.com
Featured image from DALL-E, chart from TradingView.com