Audit log

Every state-changing event for Dunamu / Upbit: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-30 23:05:25Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   9Zmxg7PeKafi…bXjgukQLcopysha256 → base58

   verifying row…

   canonical bytes (28745 B) ▸

   {"actor":"system:backfill","investigation_id":"f4b7d1d8-e03d-4c79-be28-f2db3d0ce5f5","kind":"publish","page_slug":"dunamu-upbit","published_at":"2026-07-30T23:05:25.004Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Dunamu / Upbit","sections":[{"content":"Dunamu was founded in April 2012 by Song Chi-Hyung, who holds degrees in Computer Science and Economics from Seoul National University. The company initially operated as a financial news aggregator before pivoting to crypto exchange services. Upbit launched on October 24, 2017, in partnership with American exchange Bittrex, and within months became South Korea's largest cryptocurrency exchange. As of 2025-2026, Upbit holds an estimated 80-90% domestic market share with daily trading volumes frequently exceeding $10 billion. In November 2025, Dunamu entered a merger agreement with Naver Financial, a subsidiary of Naver Corporation — South Korea's dominant internet portal company — in a deal that would further consolidate Dunamu's position in the Korean fintech ecosystem. Regulatory approvals for the merger remained outstanding as of mid-2026, with the transaction's completion deferred to December 31, 2026.","heading":"Company Overview","severity":"low","sources":[{"credibility":1,"name":"Forbes: The Ultra-Rich Korean Entrepreneur Behind One Of Crypto's Most Popular Exchanges","type":"news_article","url":"https://www.forbes.com/sites/gracechung/2018/02/07/song-chi-hyung-upbit-crypto-cryptocurrency-ether-bitcoin/"},{"credibility":2,"name":"Tiger Research: Dunamu — The Leader in the Korean Virtual Asset Market","type":"research","url":"https://reports.tiger-research.com/p/dunamu-upbit-breakdown"},{"credibility":2,"name":"Tiger Research: Dunamu x Naver Financial Merger Delayed","type":"research","url":"https://reports.tiger-research.com/p/dunamu-x-naver-financial-merger-delayed-eng"}]},{"content":"On November 27, 2025 — the same date as Upbit's 2019 hack and coinciding with a Naver Financial merger-related corporate event — attackers drained Upbit's Solana hot wallet beginning at approximately 4:42 a.m. Korea Standard Time. The breach lasted roughly 54 minutes. Stolen assets included SOL, USDC, BONK, JUP, RAY, RENDER, ORCA, PYTH, and TRUMP tokens, with the total loss estimated at 44.5 to 54 billion KRW (approximately $30-36 million USD depending on the source and exchange rate used). Dunamu stated that cold wallets were not compromised. The company immediately halted Solana-network deposits and withdrawals, relocated unaffected assets to cold storage, and coordinated with token issuers to freeze traceable funds. Dunamu subsequently recovered approximately 2.6 billion KRW through freezing procedures and compensated the remaining approximately 38.6 billion KRW in user losses from its own operational reserves. This marked Upbit's second significant hot wallet breach in six years, the first having occurred in November 2019 when approximately 342,000 ETH worth roughly 58 billion KRW was stolen.","heading":"November 2025 Hot Wallet Breach","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: South Korea Suspects North Korea-Linked Lazarus Behind $36M Upbit Hack","type":"news_article","url":"https://www.coindesk.com/markets/2025/11/28/south-korea-suspects-north-korea-linked-lazarus-behind-usd36m-upbit-hack"},{"credibility":2,"name":"Decrypt: Upbit Hack Attributed to North Korea's Lazarus as Seoul Opens Probe","type":"news_article","url":"https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe"},{"credibility":2,"name":"Halborn: Explained — The Upbit Hack (November 2025)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-upbit-hack-november-2025"},{"credibility":2,"name":"Fintech News HK: Upbit Suffers 44.5 Billion Won Hack Day After Merger with Naver","type":"news_article","url":"https://fintechnews.hk/36629/blockchain/upbit-44-5-billion-won-hack/"},{"credibility":2,"name":"Yellow.com: Upbit Loses $36M In Solana Hot Wallet Breach As Lazarus Group Emerges As Prime Suspect","type":"news_article","url":"https://yellow.com/news/upbit-loses-dollar36m-in-solana-hot-wallet-breach-as-lazarus-group-emerges-as-prime-suspect"}]},{"content":"South Korean authorities and multiple security firms have attributed the November 2025 breach to North Korea's Lazarus Group, though definitive on-chain proof had not been publicly confirmed as of early reporting. The Yonhap news agency reported that authorities cited tactical similarities to the 2019 Upbit breach, including alleged hijacking or impersonation of administrator credentials previously associated with Lazarus operations. CertiK observed that the speed and scale of withdrawals were reminiscent of Lazarus-related attacks and tracked over 100 exploiter addresses on the Solana network. The stolen funds were alleged to have been laundered using mixing techniques consistent with methods previously attributed to Lazarus. Security analysts noted a high probability of North Korean involvement given the country's documented foreign currency shortage and history of targeting crypto exchanges. The North Korean government has not publicly acknowledged involvement. The Digital Asset Security Center (DASC) and the South Korean National Police Agency were reported to be investigating. This follows the officially confirmed 2019 Upbit breach, in which South Korean authorities formally attributed the 342,000 ETH theft to Lazarus and a related group, Andariel.","heading":"Lazarus Group Attribution","severity":"high","sources":[{"credibility":1,"name":"CoinDesk: South Korea Suspects North Korea-Linked Lazarus Behind $36M Upbit Hack","type":"news_article","url":"https://www.coindesk.com/markets/2025/11/28/south-korea-suspects-north-korea-linked-lazarus-behind-usd36m-upbit-hack"},{"credibility":2,"name":"Decrypt: Upbit Hack Attributed to North Korea's Lazarus as Seoul Opens Probe","type":"news_article","url":"https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe"},{"credibility":2,"name":"DL News: Did North Korean cybercriminals hack Upbit for $36m?","type":"news_article","url":"https://www.dlnews.com/articles/regulation/did-north-korea-hackers-steal-36m-from-upbit-crypto-exchange/"},{"credibility":2,"name":"Cryptobriefing: North Korea's Lazarus Group suspected in massive Upbit crypto breach","type":"news_article","url":"https://cryptobriefing.com/lazarus-suspected-in-upbit-30m-solana-hack/"},{"credibility":2,"name":"Digital Watch Observatory: South Korea identifies North Korean hacker groups as suspects in $50M Upbit hack","type":"news_article","url":"https://dig.watch/updates/south-korea-identifies-north-korean-hacker-groups-as-suspects-in-50m-upbit-hack"}]},{"content":"A central allegation in the FSS sanction proceedings is that Dunamu delayed public disclosure of the November 2025 hack until after a Naver Financial merger-related corporate event had concluded on the same day. Multiple media reports state that Upbit did not announce the breach until later on November 27, 2025, after the merger event had finished — raising questions about whether corporate interests in preserving the deal took precedence over timely user notification. Critics and regulators argue that users and investors deserved immediate disclosure rather than notification timed around a corporate transaction. Dunamu has not publicly acknowledged the delay as improper. The FSS investigation reportedly examines this disclosure timeline as a potential violation of the Virtual Asset User Protection Act, which imposes obligations on virtual asset service providers regarding user protection. The precise content of the FSS inspection opinion letter, including specific allegations against Dunamu, had not been made fully public as of July 2026.","heading":"Alleged Disclosure Delay and Merger Conflict","severity":"high","sources":[{"credibility":1,"name":"The Block: Upbit parent Dunamu faces sanction process nearly eight months after $30 million hack","type":"news_article","url":"https://www.theblock.co/post/408848/upbit-parent-dunamu-faces-sanction-process-nearly-eight-months-after-30-million-hack-report"},{"credibility":2,"name":"BeInCrypto: Upbit's $36M SOL Hack Hits on Naver Merger Day","type":"news_article","url":"https://beincrypto.com/upbit-solana-hack-2025-loss/"},{"credibility":2,"name":"Crypto.news: South Korea targets Dunamu over Upbit hack as legal gaps emerge","type":"news_article","url":"https://crypto.news/south-korea-targets-dunamu-over-upbit-hack-as-legal-gaps-emerge/"},{"credibility":2,"name":"Cryptobriefing: South Korean regulator initiates sanctions process against Dunamu","type":"news_article","url":"https://cryptobriefing.com/south-korea-dunamu-upbit-sanctions-process/"}]},{"content":"On July 19, 2026 — approximately eight months after the November 2025 breach — the Financial Supervisory Service (FSS) issued a formal inspection opinion letter to Dunamu, opening a multi-stage sanction process. The FSS cited the hack and Dunamu's response, including the alleged disclosure delay, as the basis for the proceedings. Under South Korean regulatory procedure, Dunamu is given an opportunity to respond to the FSS's findings. After Dunamu's response, the FSS may notify a proposed sanction level. The case then passes through the Sanctions Review Committee, is elevated to the Securities and Futures Commission (SFC), and finally the Financial Services Commission (FSC) issues or adjusts any final penalty. A significant legal uncertainty complicates the proceedings: South Korea's Virtual Asset User Protection Act, enacted in its first phase in July 2024, does not contain direct penalty provisions for hacking incidents or computer system breaches. FSS Governor Lee Chan-jin acknowledged this gap at a December 2025 press conference, stating that the act does not provide sufficient legal grounds to hold service providers fully accountable for such incidents. The maximum severity of any eventual penalty therefore remained unclear as of the investigation date. No penalty had been formally proposed as of July 2026.","heading":"FSS Sanction Proceedings (July 2026)","severity":"critical","sources":[{"credibility":1,"name":"The Block: Upbit parent Dunamu faces sanction process nearly eight months after $30 million hack","type":"news_article","url":"https://www.theblock.co/post/408848/upbit-parent-dunamu-faces-sanction-process-nearly-eight-months-after-30-million-hack-report"},{"credibility":2,"name":"Crowdfund Insider: South Korean Financial Regulator Advances Sanction Proceedings Against Dunamu","type":"news_article","url":"https://www.crowdfundinsider.com/2026/07/292742-south-korean-financial-regulator-advances-sanction-proceedings-against-dunamu-upbits-parent-company-months-after-major-security-incident/"},{"credibility":2,"name":"CoinLaw: FSS Opens Sanctions Process Against Dunamu Over Upbit Hack","type":"news_article","url":"https://coinlaw.io/fss-sanctions-dunamu-upbit-hack/"},{"credibility":2,"name":"Cryptobriefing: South Korean regulator initiates sanctions process against Dunamu","type":"news_article","url":"https://cryptobriefing.com/south-korea-dunamu-upbit-sanctions-process/"},{"credibility":2,"name":"Crypto Daily: Upbit's $30M Hack: FSS Opens Sanctions Review on Dunamu","type":"news_article","url":"https://cryptodaily.co.uk/2026/07/dunamu-sanctions-review-upbit-30m-hack"}]},{"content":"Separate from the 2025 hack, Dunamu faced significant regulatory action from South Korea's Financial Intelligence Unit (FIU) over anti-money laundering (AML) and Know Your Customer (KYC) compliance failures. In January 2025, the FIU issued a preliminary notice of sanctions. Regulators identified approximately 34,777 KYC violations, 5,785 cases of incorrect or missing address details, approximately 5.3 million instances of insufficient customer identity verification, 15 unreported suspicious transactions, and 44,948 virtual asset transfers conducted with 19 unregistered foreign service providers. In February 2025, the FIU imposed sanctions that included a disciplinary warning to Dunamu's CEO, a three-month suspension on new customer deposits, withdrawals, and transfers, and a fine of approximately 35.2 billion KRW (roughly $25 million). Dunamu indicated it would appeal the sanctions and argued the restrictions were disproportionate. A court order in April 2026 partially reversed the customer transfer suspension. These AML proceedings were ongoing concurrently with the hack-related FSS sanction process.","heading":"AML and KYC Violations (2024-2025)","severity":"high","sources":[{"credibility":1,"name":"CoinDesk: Upbit Considering Appeal of $25M Fine by South Korea Regulator","type":"news_article","url":"https://www.coindesk.com/policy/2025/11/25/upbit-considering-appeal-of-usd25m-fine-by-south-korea-regulator"},{"credibility":2,"name":"Cryptobriefing: Upbit faces business suspension and fines over anti-money laundering violations","type":"news_article","url":"https://cryptobriefing.com/upbit-sanctions-over-aml-kyc/"},{"credibility":2,"name":"Phemex News: Upbit Faces $25 Million Fine Over AML and KYC Violations","type":"news_article","url":"https://phemex.com/news/article/upbit-faces-25-million-fine-over-aml-and-kyc-violations-39417"},{"credibility":2,"name":"Finance Magnates: South Korea's Crypto Exchange Upbit Faces Suspension Over KYC Violations","type":"news_article","url":"https://www.financemagnates.com/cryptocurrency/south-koreas-crypto-exchange-upbit-faces-suspension-over-kyc-violations/"},{"credibility":2,"name":"AML Intelligence: Upbit hit with three month ban on servicing new users","type":"news_article","url":"https://www.amlintelligence.com/2025/02/news-upbit-hit-with-three-month-users/"}]},{"content":"The November 2025 hack is Upbit's second major security failure. In November 2019, attackers stole approximately 342,000 ETH (then valued at roughly 58 billion KRW) from Upbit's hot wallets. South Korean authorities later formally attributed that breach to Lazarus Group and a related North Korean cyber unit, Andariel. The timing of the 2025 breach — occurring exactly six years after the 2019 incident — was noted by multiple analysts and media outlets. In the 2019 case, Upbit also covered user losses from its own funds. The recurrence of a hot wallet breach attributable to the same threat actor raises questions about the exchange's long-term security posture, though Upbit maintained that it had implemented additional cold storage measures in the intervening years.","heading":"2019 Hot Wallet Breach (Historical Context)","severity":"high","sources":[{"credibility":2,"name":"Digital Watch Observatory: South Korea identifies North Korean hacker groups as suspects in $50M Upbit hack","type":"news_article","url":"https://dig.watch/updates/south-korea-identifies-north-korean-hacker-groups-as-suspects-in-50m-upbit-hack"},{"credibility":2,"name":"Cryptopolitan: South Korean regulators lose patience after Upbit hack","type":"news_article","url":"https://www.cryptopolitan.com/south-korean-regulators-upbit-hack/"},{"credibility":2,"name":"Fintech Hong Kong: Upbit Suffers 44.5 Billion Won Hack Day After Merger with Naver","type":"news_article","url":"https://fintechnews.hk/36629/blockchain/upbit-44-5-billion-won-hack/"}]},{"content":"On July 7, 2026, BonkDAO — the governance body for the BONK token on Solana — suffered a governance attack in which a malicious proposal (Bonk Improvement Proposal #76, titled 'Sowellian BonkDAO') was passed using accumulated voting power, draining approximately $20 million in BONK tokens from the treasury. The BONK token price fell approximately 9% following the incident. Upbit suspended BONK deposits and withdrawals in response, explicitly citing 'user protection measures following the circumstances of a security incident.' This suspension was separate from and unrelated to the November 2025 hack proceedings, but occurred during the same period as the FSS's active sanction process against Dunamu. Upbit's response to the BonkDAO attack — immediately suspending the affected asset — contrasted with the alleged delay in disclosing its own November 2025 breach.","heading":"BonkDAO Governance Attack and Upbit BONK Suspension (July 2026)","severity":"medium","sources":[{"credibility":2,"name":"KuCoin: BonkDAO Hit by Governance Attack, Loses $20M in BONK as Upbit Pauses Services","type":"news_article","url":"https://www.kucoin.com/news/flash/bonkdao-hit-by-governance-attack-loses-20m-in-bonk-as-upbit-pauses-services"},{"credibility":1,"name":"The Block: BonkDAO loses $20 million following 'malicious governance proposal' attack","type":"news_article","url":"https://www.theblock.co/post/407343/bonkdao-loses-20-million-following-malicious-governance-proposal-attack"},{"credibility":2,"name":"Crypto.news: The BONK governance attack — How a DAO lost $20 million in one proposal","type":"news_article","url":"https://crypto.news/the-bonk-governance-attack-how-a-dao-lost-20-million-in-one-proposal/"}]},{"content":"A structural issue complicating enforcement against Dunamu is the scope of South Korea's Virtual Asset User Protection Act (VAUPA), which came into force in its first phase in July 2024. FSS Governor Lee Chan-jin stated publicly in December 2025 that the Act does not provide sufficient legal grounds to hold virtual asset service providers fully accountable for hacking incidents or computer system breaches, as it focuses primarily on user asset protection and unfair trading rather than security incident liability. This legal gap means the sanction process against Dunamu over the 2025 hack operates in uncertain territory. South Korean regulators and legislators signaled in late 2025 and 2026 that they intended to move toward bank-level security obligations for crypto exchanges, potentially including no-fault liability, stricter IT risk standards, and revenue-linked fines. Whether existing law is sufficient to impose material penalties on Dunamu for the 2025 breach remained unresolved at the time of this investigation.","heading":"Regulatory and Legal Uncertainty","severity":"medium","sources":[{"credibility":2,"name":"Crypto.news: South Korea targets Dunamu over Upbit hack as legal gaps emerge","type":"news_article","url":"https://crypto.news/south-korea-targets-dunamu-over-upbit-hack-as-legal-gaps-emerge/"},{"credibility":2,"name":"CoinLaw: FSS Opens Sanctions Process Against Dunamu Over Upbit Hack","type":"news_article","url":"https://coinlaw.io/fss-sanctions-dunamu-upbit-hack/"},{"credibility":2,"name":"TradingView / CryptoNews: Korea to Treat Crypto Exchanges Like Banks After Upbit Hack","type":"news_article","url":"https://www.tradingview.com/news/cryptonews:cf9b987c3094b:0-korea-to-treat-crypto-exchanges-like-banks-after-upbit-hack/"}]}],"sources_used":[{"credibility":1,"name":"The Block: Upbit parent Dunamu faces sanction process nearly eight months after $30 million hack","type":"news_article","url":"https://www.theblock.co/post/408848/upbit-parent-dunamu-faces-sanction-process-nearly-eight-months-after-30-million-hack-report"},{"credibility":1,"name":"CoinDesk: South Korea Suspects North Korea-Linked Lazarus Behind $36M Upbit Hack","type":"news_article","url":"https://www.coindesk.com/markets/2025/11/28/south-korea-suspects-north-korea-linked-lazarus-behind-usd36m-upbit-hack"},{"credibility":1,"name":"CoinDesk: Upbit Considering Appeal of $25M Fine by South Korea Regulator","type":"news_article","url":"https://www.coindesk.com/policy/2025/11/25/upbit-considering-appeal-of-usd25m-fine-by-south-korea-regulator"},{"credibility":2,"name":"Decrypt: Upbit Hack Attributed to North Korea's Lazarus as Seoul Opens Probe","type":"news_article","url":"https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe"},{"credibility":2,"name":"Crowdfund Insider: South Korean Financial Regulator Advances Sanction Proceedings Against Dunamu","type":"news_article","url":"https://www.crowdfundinsider.com/2026/07/292742-south-korean-financial-regulator-advances-sanction-proceedings-against-dunamu-upbits-parent-company-months-after-major-security-incident/"},{"credibility":2,"name":"Cryptobriefing: South Korean regulator initiates sanctions process against Dunamu","type":"news_article","url":"https://cryptobriefing.com/south-korea-dunamu-upbit-sanctions-process/"},{"credibility":2,"name":"Cryptobriefing: Upbit faces business suspension and fines over anti-money laundering violations","type":"news_article","url":"https://cryptobriefing.com/upbit-sanctions-over-aml-kyc/"},{"credibility":2,"name":"Cryptobriefing: North Korea's Lazarus Group suspected in massive Upbit crypto breach","type":"news_article","url":"https://cryptobriefing.com/lazarus-suspected-in-upbit-30m-solana-hack/"},{"credibility":1,"name":"The Block: BonkDAO loses $20 million following 'malicious governance proposal' attack","type":"news_article","url":"https://www.theblock.co/post/407343/bonkdao-loses-20-million-following-malicious-governance-proposal-attack"},{"credibility":2,"name":"Halborn: Explained — The Upbit Hack (November 2025)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-upbit-hack-november-2025"},{"credibility":2,"name":"BeInCrypto: Upbit's $36M SOL Hack Hits on Naver Merger Day","type":"news_article","url":"https://beincrypto.com/upbit-solana-hack-2025-loss/"},{"credibility":2,"name":"CoinLaw: FSS Opens Sanctions Process Against Dunamu Over Upbit Hack","type":"news_article","url":"https://coinlaw.io/fss-sanctions-dunamu-upbit-hack/"},{"credibility":2,"name":"Crypto.news: South Korea targets Dunamu over Upbit hack as legal gaps emerge","type":"news_article","url":"https://crypto.news/south-korea-targets-dunamu-over-upbit-hack-as-legal-gaps-emerge/"},{"credibility":2,"name":"Finance Magnates: South Korea's Crypto Exchange Upbit Faces Suspension Over KYC Violations","type":"news_article","url":"https://www.financemagnates.com/cryptocurrency/south-koreas-crypto-exchange-upbit-faces-suspension-over-kyc-violations/"},{"credibility":2,"name":"Phemex News: Upbit Faces $25 Million Fine Over AML and KYC Violations","type":"news_article","url":"https://phemex.com/news/article/upbit-faces-25-million-fine-over-aml-and-kyc-violations-39417"},{"credibility":2,"name":"DL News: Did North Korean cybercriminals hack Upbit for $36m?","type":"news_article","url":"https://www.dlnews.com/articles/regulation/did-north-korea-hackers-steal-36m-from-upbit-crypto-exchange/"},{"credibility":2,"name":"Fintech News HK: Upbit Suffers 44.5 Billion Won Hack Day After Merger with Naver","type":"news_article","url":"https://fintechnews.hk/36629/blockchain/upbit-44-5-billion-won-hack/"},{"credibility":1,"name":"Forbes: The Ultra-Rich Korean Entrepreneur Behind One Of Crypto's Most Popular Exchanges","type":"news_article","url":"https://www.forbes.com/sites/gracechung/2018/02/07/song-chi-hyung-upbit-crypto-cryptocurrency-ether-bitcoin/"},{"credibility":2,"name":"Tiger Research: Dunamu — The Leader in the Korean Virtual Asset Market","type":"research","url":"https://reports.tiger-research.com/p/dunamu-upbit-breakdown"},{"credibility":2,"name":"Digital Watch Observatory: South Korea identifies North Korean hacker groups as suspects in $50M Upbit hack","type":"news_article","url":"https://dig.watch/updates/south-korea-identifies-north-korean-hacker-groups-as-suspects-in-50m-upbit-hack"},{"credibility":2,"name":"Cryptopolitan: South Korean regulators lose patience after Upbit hack","type":"news_article","url":"https://www.cryptopolitan.com/south-korean-regulators-upbit-hack/"},{"credibility":2,"name":"The Cryptonomist: Upbit $30 Million Hack Spurs Dunamu Sanction Process","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/20/upbit-30-million-hack/"}],"summary":"Dunamu is the South Korean fintech company that operates Upbit, the country's dominant cryptocurrency exchange holding approximately 80-90% domestic market share. In November 2025, Upbit suffered its second major hot wallet breach in six years, losing approximately 44.5-54 billion KRW (roughly $30-36 million) in Solana-based assets attributed by South Korean authorities to North Korea's Lazarus Group. South Korea's Financial Supervisory Service formally initiated sanction proceedings against Dunamu on July 19, 2026, focusing in part on the alleged delay in public disclosure of the hack until after a Naver Financial merger event had concluded.","timeline":[{"date":"2019-11-27","event":"Upbit's first major hot wallet breach: approximately 342,000 ETH (roughly 58 billion KRW) stolen. South Korean authorities later attribute the attack to North Korea's Lazarus Group and Andariel.","source":"Digital Watch Observatory / Cryptopolitan","source_url":"https://dig.watch/updates/south-korea-identifies-north-korean-hacker-groups-as-suspects-in-50m-upbit-hack"},{"date":"2024-07-01","event":"South Korea's Virtual Asset User Protection Act (first phase) enters into force, creating initial regulatory framework for virtual asset service providers.","source":"CoinLaw / Cryptobriefing","source_url":"https://coinlaw.io/fss-sanctions-dunamu-upbit-hack/"},{"date":"2025-01-09","event":"South Korea's Financial Intelligence Unit (FIU) issues a preliminary notice of sanctions against Dunamu over AML and KYC compliance violations, including approximately 34,777 KYC failures and transfers with 19 unregistered foreign service providers.","source":"Finance Magnates / Phemex News","source_url":"https://www.financemagnates.com/cryptocurrency/south-koreas-crypto-exchange-upbit-faces-suspension-over-kyc-violations/"},{"date":"2025-02-01","event":"FIU imposes sanctions on Dunamu: a 35.2 billion KRW (~$25M) fine, a disciplinary warning to Dunamu's CEO, and a three-month suspension on new customer deposits, withdrawals, and transfers.","source":"AML Intelligence / CoinDesk","source_url":"https://www.coindesk.com/policy/2025/11/25/upbit-considering-appeal-of-usd25m-fine-by-south-korea-regulator"},{"date":"2025-11-27","event":"Upbit's Solana hot wallet is breached beginning at 4:42 a.m. KST. Attackers drain 44.5-54 billion KRW (~$30-36M) in Solana-based assets over approximately 54 minutes. The incident coincides with a Naver Financial merger-related corporate event. Public disclosure allegedly occurs only after that event concludes.","source":"CoinDesk / The Block / BeInCrypto","source_url":"https://www.coindesk.com/markets/2025/11/28/south-korea-suspects-north-korea-linked-lazarus-behind-usd36m-upbit-hack"},{"date":"2025-11-28","event":"South Korean authorities announce suspicion that North Korea's Lazarus Group is responsible for the Upbit hack. Seoul opens a formal investigation. Dunamu states it will fully reimburse affected users.","source":"CoinDesk / Decrypt","source_url":"https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe"},{"date":"2025-12-01","event":"FSS Governor Lee Chan-jin states at a press conference that the Virtual Asset User Protection Act does not provide sufficient legal grounds to hold service providers fully accountable for hacking incidents, signaling the regulatory gap that would later complicate sanction proceedings.","source":"CoinLaw / Cryptobriefing","source_url":"https://coinlaw.io/fss-sanctions-dunamu-upbit-hack/"},{"date":"2026-02-01","event":"Dunamu recovers approximately 2.6 billion KRW in frozen attacker assets and compensates users for the remaining 38.6 billion KRW loss from its own reserves.","source":"KuCoin News / Cryptobriefing","source_url":"https://www.kucoin.com/news/flash/south-korean-financial-supervisory-service-initiates-sanction-process-against-dunamu-parent-of-upbit"},{"date":"2026-04-01","event":"A court order partially reverses the FIU's February 2025 customer transfer suspension against Dunamu.","source":"Cryptobriefing","source_url":"https://cryptobriefing.com/south-korea-dunamu-upbit-sanctions-process/"},{"date":"2026-07-07","event":"BonkDAO suffers a $20 million governance attack via malicious proposal BIP #76. Upbit suspends BONK deposits and withdrawals citing user protection. BONK price falls approximately 9%.","source":"The Block","source_url":"https://www.theblock.co/post/407343/bonkdao-loses-20-million-following-malicious-governance-proposal-attack"},{"date":"2026-07-19","event":"The FSS formally issues an inspection opinion letter to Dunamu, initiating a multi-stage sanction process over the November 2025 hack and alleged disclosure delay. No penalty has been proposed at this stage.","source":"The Block / Crowdfund Insider","source_url":"https://www.theblock.co/post/408848/upbit-parent-dunamu-faces-sanction-process-nearly-eight-months-after-30-million-hack-report"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d12eb789-de0f-4f81-9e7b-5eb23c4502a4copy