Upbit Suspends Withdrawals After Solana Network Hot Wallet Outflow

Dunamu Inc., the operator of South Korea's largest cryptocurrency exchange Upbit, says it has detected an unauthorized transfer from a Solana network hot wallet early on November 27, 2025 and has temporarily suspended deposits and withdrawals across the assets it supports. Blockchain security monitors, including PeckShield, flagged the transfer of approximately 54 billion won, about 36 to 37 million dollars. Upbit says it will cover the loss from its own reserves while it carries out an internal investigation and security review.

The exchange moved swiftly to contain operations, blocking off chain transfers while maintaining trading on its platform, a measure intended to preserve market liquidity and give users access to spot trading. The suspension of deposits and withdrawals is a standard emergency response aimed at preventing further unauthorized movements as security teams trace the outflow and assess the method of compromise.

The incident arrives on a day of heightened attention for Dunamu. Naver Financial announced an acquisition of Dunamu on the same day, a development that drew market scrutiny and amplified concerns among investors and regulators. The timing raises questions about deal terms, integration risks and the potential for tighter regulatory review as South Korean authorities watch the fallout.

Hot wallets are internet connected addresses used by exchanges to facilitate rapid withdrawals and deposits. They hold only a portion of overall customer assets by design, while larger stores of value are typically kept in cold wallets that are offline. Nonetheless, hot wallet compromises have repeatedly proved costly for exchanges because they enable immediate transfers on public blockchains. Upbit's pledge to absorb the loss from corporate reserves is intended to reassure users that client funds will not be directly impacted, at least in the immediate term.

Security firms and blockchain analysts will likely focus on tracing the transaction through Solana network records to determine whether the funds can be frozen, recovered or laundered. Solana's on chain transparency allows monitors to follow token flows, but recovery often depends on cooperation from downstream custodians and centralized services or on finding vulnerabilities in mixing techniques.

For customers and investors, the key questions are how the breach occurred, whether further pockets of vulnerability exist, and what steps Dunamu will take to prevent recurrence. The internal investigation is expected to probe access controls, operational procedures and third party integrations that touch hot wallet operations. Regulators in South Korea have tightened oversight of crypto firms in recent years, and a security incident of this scale is likely to prompt inquiries from financial authorities.

Market impact beyond immediate trading on Upbit remains uncertain. The exchange has kept trading functions live, reducing the risk of a broader liquidity squeeze, but reputational damage and potential legal or regulatory consequences could affect Dunamu's valuation and the planned acquisition by Naver Financial. Observers will be watching for updates from Dunamu and any statements from regulators, as well as for blockchain tracing results from independent security firms.