Dunamu / Upbit
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·21Gubu…LvsQSummary
Dunamu is the South Korean fintech company that operates Upbit, the country's dominant cryptocurrency exchange holding approximately 80-90% domestic market share. In November 2025, Upbit suffered its second major hot wallet breach in six years, losing approximately 44.5-54 billion KRW (roughly $30-36 million) in Solana-based assets attributed by South Korean authorities to North Korea's Lazarus Group. South Korea's Financial Supervisory Service formally initiated sanction proceedings against Dunamu on July 19, 2026, focusing in part on the alleged delay in public disclosure of the hack until after a Naver Financial merger event had concluded.
Connected Entities
1 entities- + 1 more
Timeline(11 events)
27 November 2019
Upbit's first major hot wallet breach: approximately 342,000 ETH (roughly 58 billion KRW) stolen. South Korean authorities later attribute the attack to North Korea's Lazarus Group and Andariel.
Digital Watch Observatory / CryptopolitanJuly 2024
South Korea's Virtual Asset User Protection Act (first phase) enters into force, creating initial regulatory framework for virtual asset service providers.
CoinLaw / Cryptobriefing9 January 2025
South Korea's Financial Intelligence Unit (FIU) issues a preliminary notice of sanctions against Dunamu over AML and KYC compliance violations, including approximately 34,777 KYC failures and transfers with 19 unregistered foreign service providers.
Finance Magnates / Phemex NewsFebruary 2025
FIU imposes sanctions on Dunamu: a 35.2 billion KRW (~$25M) fine, a disciplinary warning to Dunamu's CEO, and a three-month suspension on new customer deposits, withdrawals, and transfers.
AML Intelligence / CoinDesk27 November 2025
Upbit's Solana hot wallet is breached beginning at 4:42 a.m. KST. Attackers drain 44.5-54 billion KRW (~$30-36M) in Solana-based assets over approximately 54 minutes. The incident coincides with a Naver Financial merger-related corporate event. Public disclosure allegedly occurs only after that event concludes.
CoinDesk / The Block / BeInCrypto28 November 2025
South Korean authorities announce suspicion that North Korea's Lazarus Group is responsible for the Upbit hack. Seoul opens a formal investigation. Dunamu states it will fully reimburse affected users.
CoinDesk / DecryptDecember 2025
FSS Governor Lee Chan-jin states at a press conference that the Virtual Asset User Protection Act does not provide sufficient legal grounds to hold service providers fully accountable for hacking incidents, signaling the regulatory gap that would later complicate sanction proceedings.
CoinLaw / CryptobriefingFebruary 2026
Dunamu recovers approximately 2.6 billion KRW in frozen attacker assets and compensates users for the remaining 38.6 billion KRW loss from its own reserves.
KuCoin News / CryptobriefingApril 2026
A court order partially reverses the FIU's February 2025 customer transfer suspension against Dunamu.
Cryptobriefing7 July 2026
BonkDAO suffers a $20 million governance attack via malicious proposal BIP #76. Upbit suspends BONK deposits and withdrawals citing user protection. BONK price falls approximately 9%.
The Block19 July 2026
The FSS formally issues an inspection opinion letter to Dunamu, initiating a multi-stage sanction process over the November 2025 hack and alleged disclosure delay. No penalty has been proposed at this stage.
The Block / Crowdfund InsiderDecision Log
- hash: Dijnqvz96QesorCzJ5mCeiqAUQww7RkYhWrFSxJjE75Q
- hash: AsBaXkmic9C7xbtk2TitMHFM5MZu9gy18jG6nBQ25kHS
- hash: 9Zmxg7PeKafi6FUFoHCz2tQTNhH76jYsD7NrbXjgukQL
This investigation is cryptographically anchored to the Solana blockchain (3 events). 22 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/30/2026, 11:05:11 PM
last updated: 8/26/2026, 10:07:22 PM
4 viewsavoid.net — verified advice for a post-truth world