Home > Business > Industry

Upbit lost more than 100 billion crypto coins in less than an hour in November data breach

Published: 07 Dec. 2025, 14:41 Updated: 07 Dec. 2025, 16:56

Upbit company logo seen at its customer service center in Gangnam District, southern Seoul, on Jan. 21 [NEWS1]

More than 100 billion cryptocurrency coins were stolen from crypto exchange Upbit in just 54 minutes during a hack last month, according to a lawmaker’s office on Sunday.

The data breach took place from 4:42 a.m. to 5:36 a.m. on Nov. 27, according to data from the Financial Supervisory Service (FSS) as disclosed by Rep. Kang Min-kuk of the National Assembly’s Political Affairs Committee on Sunday.

During that time frame, a total of approximately 104.06 billion coins — valued at around 44.5 billion won ($30.2 million) — were siphoned off to unknown external wallets. That equates to roughly 32 million coins per second, or 13.7 million won in value every second.

By volume, the largest portion of the stolen assets were Bonk (BONK) tokens — 103.12 billion coins, accounting for 99.1 percent of the stolen amount but worth just 1.53 billion won.

By value, the biggest losses were in Solana (SOL) at 18.99 billion won, or 42.7 percent of the total. Pudgy Penguins (PENGU) followed with 3.85 billion won or 8.7 percent, then Official Trump (TRUMP) with 2.92 billion won or 6.6 percent.

Upbit held an emergency meeting at 5 a.m., 18 minutes after detecting the suspicious activity, and suspended deposits and withdrawals of Solana-based digital assets at 5:27 a.m. By 8:55 a.m., it had halted all digital asset transactions.

However, the first report to the FSS only came at 10:58 a.m. — six hours after the initial breach. The Korea Internet & Security Agency (KISA) was notified at 11:57 a.m., police at 1:16 p.m. and the Financial Services Commission at 3 p.m. The company issued a public notice on its website at 12:33 p.m.

A digital screen on cryptocurrency trading platform company Upbit's office in Gangnam District, southern Seoul, shows the price of Bitcoin falling on Nov. 18. [NEWS1]

“It’s alarming that Upbit, the top crypto exchange in Korea, delayed reporting the theft of more than 100 billion coins by over six hours,” Rep. Kang said. “A full investigation is needed to determine whether the fault lies with Solana’s platform structure or Upbit’s account management system.”

Currently, there is no direct legal clause that dictates penalties or compensation claims in the event of a hacking incident involving a virtual asset service provider. The Electronic Financial Transactions Act holds financial institutions liable for unavoidable risks as system managers but does not cover cryptocurrency businesses.

The Act on the Protection of Virtual Asset Users, implemented in July 2023, is focused on user protection and does not contain specific regulations on sanctions for hacking or system failures. Because of this legal gap, the FSS’s ongoing on-site inspection of Upbit is unlikely to result in heavy disciplinary action, observers say.

“Over 80 percent of customer assets were stored in cold wallets, and we took immediate action to prevent user losses by covering the stolen assets ourselves,” said an Upbit spokesperson. “Our focus was on halting further unauthorized withdrawals, and we reported the incident as soon as the abnormal activity was confirmed to be a breach.”

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
BY CHO MUN-GYU [[email protected]]