Upbit Shifts Most Customer Funds to Cold Storage Following $30 Million Hot Wallet Hack

Summary:
South Korea's largest cryptocurrency exchange, Upbit, is transferring nearly all user funds into cold storage following a significant hack of its Solana hot wallet, which resulted in losses of approximately $30 million. This move represents a substantial shift in security strategy, aiming to protect customer assets.

Key Takeaways

Upbit is increasing the share of customer funds in cold storage to 99% after a $30 million hack.
The exchange will reduce its hot wallet usage to almost zero, enhancing security measures.
Following the incident, Upbit plans to offer full reimbursements to affected users.
South Korea's regulatory landscape may change, imposing stricter security standards for cryptocurrency exchanges.

Upbit

Cold Storage vs. Hot Wallet: A Strategic Shift

Upbit, South Korea's leading crypto exchange, has decided to move nearly all customer assets into cold storage. This decision comes after a significant breach of its Solana hot wallet, marking one of the most aggressive security adjustments made by a trading platform.

The operator, Dunamu, expressed its intention to increase the percentage of user funds held in cold wallets to 99%, effectively reducing exposure to hot wallets to nearly zero. This move follows the theft of 44.5 billion won (about $30 million) from a connected wallet.

This transition takes Upbit well beyond the requirements of South Korea's Virtual Asset User Protection Act, which mandates that exchanges keep at least 80% of customer deposits in offline storage.

Implementing Enhanced Security Measures

Cold wallets are used to store digital assets offline, making them significantly harder to hack, although they can slow down transactions. In contrast, hot wallets are online and facilitate immediate deposits and withdrawals, making them more convenient but also more vulnerable to cyberattacks.

With a goal of having 99% of funds in cold storage, Upbit minimizes the risk of losing a larger pool of assets in case a hot wallet is compromised again. As of the end of October 2025, Dunamu reported that 98.33% of customer assets were already in cold storage, with only 1.67% in hot wallets.

Even prior to the hack, Upbit had the lowest proportion of funds in hot wallets among domestic exchanges, while its competitors maintained a range of cold wallet ratios between 82% and 90%. The exchange has managed to keep a high cold storage ratio despite rising cryptocurrency prices and increased activity from new listings, completing a thorough review of its wallet infrastructure to enhance security.

Emergency Response to Solana Network Attack

This recent security overhaul was prompted by a hack initially estimated at 54 billion won (approximately $36 million) linked to Solana's network. Following a detailed review, Upbit revised the loss figure to 44.5 billion won and confirmed that 38.6 billion won (around $26.2 million) represented direct losses to users, for which the company has vowed to provide full compensation from its own reserves.

The hacked tokens included Solana's SOL alongside ORCA, RAY, and JUP. Once Upbit detected unusual withdrawal activity, it halted all operations, transitioned remaining assets into cold storage, and initiated a forensic investigation.

Regulatory Implications for the Crypto Industry

The findings of Upbit’s engineering team revealed potential vulnerabilities in the exchange's wallet software, indicating that attackers might have exploited these weaknesses by analyzing public blockchain data to obtain private keys. Although Upbit has not confirmed whether this exact vulnerability was tied to the breach, the incident emphasizes the need to consider hot wallet exposure as a systemic risk that needs to be minimized, rather than merely patched.

The fallout from this incident is prompting a re-evaluation of regulations within the cryptocurrency sector. South Korea’s Financial Services Commission is exploring new rules that could impose bank-level liability standards on leading crypto exchanges. These regulations could require mandatory compensation for hacks and system failures, regardless of fault, much like the obligations faced by traditional banks and electronic payment companies under the country’s electronic financial transactions law.

Should these policies be enacted, cryptocurrency exchanges operating in South Korea may need to bolster their security systems and expand their financial reserves, aligning more closely with the requirements of traditional financial institutions.

Upbit's decisive action to shift nearly all of its customer funds into cold storage highlights the lengths a leading exchange is willing to go to ensure user confidence and safeguard digital assets from potential cyber threats.