Dunamu / Upbit
Last changed 2026-10-27 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 30 → 39. Problems weighed by who is responsible: concerns that are not fraud −25.2, incidents the subject suffered −20, problems around the subject, caused by others −1.1; legitimacy credit long-running +10; the penalty for incidents it suffered is capped at 20; fact-check adjustments (−8) now shown as page reliability, not in the score. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -25.2 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -1.1 |
| Long-running | +10 |
| Sum | 29 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 39/100 (kept between 0 and 100)
How scoring works →Summary
Dunamu is the South Korean fintech company that operates Upbit, the country's dominant cryptocurrency exchange holding approximately 80-90% domestic market share. In November 2025, Upbit suffered its second major hot wallet breach in six years, losing approximately 44.5-54 billion KRW (roughly $30-36 million) in Solana-based assets attributed by South Korean authorities to North Korea's Lazarus Group. South Korea's Financial Supervisory Service formally initiated sanction proceedings against Dunamu on July 19, 2026, focusing in part on the alleged delay in public disclosure of the hack until after a Naver Financial merger event had concluded.
Connected Entities
6 entities · 60 linked investigations- BonkDAO→mentioned with→Solana(80%)
- Render Network→mentioned with→Solana(80%)
- Bonk→mentioned with→Solana(80%)
- Dunamu / Upbit→mentioned with→Solana(80%)
- Dunamu / Upbit→mentioned with→BonkDAO(70%)
- Dunamu / Upbit→mentioned with→Render Network(60%)
- Dunamu / Upbit→mentioned with→Bonk(70%)
- Dunamu / Upbit→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→Solana(70%)
- BonkDAO→mentioned with→Bonk(70%)
Connected Through
6 shared actors · 395 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Solanaorganization
- □North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaignorganization
- □Bonkorganization
- □BonkDAOorganization
Timeline(11 events)
27 November 2019
Upbit's first major hot wallet breach: approximately 342,000 ETH (roughly 58 billion KRW) stolen. South Korean authorities later attribute the attack to North Korea's Lazarus Group and Andariel.
Digital Watch Observatory / CryptopolitanJuly 2024
South Korea's Virtual Asset User Protection Act (first phase) enters into force, creating initial regulatory framework for virtual asset service providers.
CoinLaw / Cryptobriefing9 January 2025
South Korea's Financial Intelligence Unit (FIU) issues a preliminary notice of sanctions against Dunamu over AML and KYC compliance violations, including approximately 34,777 KYC failures and transfers with 19 unregistered foreign service providers.
Finance Magnates / Phemex NewsFebruary 2025
FIU imposes sanctions on Dunamu: a 35.2 billion KRW (~$25M) fine, a disciplinary warning to Dunamu's CEO, and a three-month suspension on new customer deposits, withdrawals, and transfers.
AML Intelligence / CoinDesk27 November 2025
Upbit's Solana hot wallet is breached beginning at 4:42 a.m. KST. Attackers drain 44.5-54 billion KRW (~$30-36M) in Solana-based assets over approximately 54 minutes. The incident coincides with a Naver Financial merger-related corporate event. Public disclosure allegedly occurs only after that event concludes.
CoinDesk / The Block / BeInCrypto28 November 2025
South Korean authorities announce suspicion that North Korea's Lazarus Group is responsible for the Upbit hack. Seoul opens a formal investigation. Dunamu states it will fully reimburse affected users.
CoinDesk / DecryptDecember 2025
FSS Governor Lee Chan-jin states at a press conference that the Virtual Asset User Protection Act does not provide sufficient legal grounds to hold service providers fully accountable for hacking incidents, signaling the regulatory gap that would later complicate sanction proceedings.
CoinLaw / CryptobriefingFebruary 2026
Dunamu recovers approximately 2.6 billion KRW in frozen attacker assets and compensates users for the remaining 38.6 billion KRW loss from its own reserves.
KuCoin News / CryptobriefingApril 2026
A court order partially reverses the FIU's February 2025 customer transfer suspension against Dunamu.
Cryptobriefing7 July 2026
BonkDAO suffers a $20 million governance attack via malicious proposal BIP #76. Upbit suspends BONK deposits and withdrawals citing user protection. BONK price falls approximately 9%.
The Block19 July 2026
The FSS formally issues an inspection opinion letter to Dunamu, initiating a multi-stage sanction process over the November 2025 hack and alleged disclosure delay. No penalty has been proposed at this stage.
The Block / Crowdfund InsiderDecision Log
- slot 461965284 · hash 4ZmVwHCKyBf2oPTVGPA6TAr3JuS6u5HYEnxCKqmubuS4
- slot 459451252 · hash AmdnNaDquSNdSZkUWuqh1mZ48PibBwgQaJ5TaXNqXcpY
- slot 443522309 · hash Dijnqvz96QesorCzJ5mCeiqAUQww7RkYhWrFSxJjE75Q
- slot 443522182 · hash AsBaXkmic9C7xbtk2TitMHFM5MZu9gy18jG6nBQ25kHS
- slot 443502960 · hash 9Zmxg7PeKafi6FUFoHCz2tQTNhH76jYsD7NrbXjgukQL
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 22 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/30/2026, 11:05:11 PM
last updated: 10/27/2026, 6:05:17 AM
5 viewsavoid.net — verified advice for a post-truth world