Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #14[disputed][awaiting moderator]in section: AML and KYC Violations (2024-2025)

   “In February 2025, the FIU imposed sanctions that included a disciplinary warning to Dunamu's CEO, a three-month suspension on new customer deposits, withdrawals, and transfers, and a fine of approximately 35.2 billion KRW (roughly $25 million).”

   reviewerIn February 2025, the FIU imposed sanctions that included a disciplinary warning to Dunamu's CEO, a three-month suspension on new customer deposits, withdrawals, and transfers, and a fine of approximately 35.2 billion KRW (roughly $25 million).The CEO warning and suspension were indeed decided in February 2025, but the 35.2 billion KRW fine itself was a separate, later action imposed around November 6, 2025 — the page conflates the two into a single February 2025 event.
   Proposed correction (not yet applied)

   In February 2025, the FIU imposed sanctions that included a disciplinary warning to Dunamu's CEO and a three-month suspension on new customer deposits, withdrawals, and transfers; the FIU's fine of approximately 35.2 billion KRW (roughly $25 million) over the same violations was not imposed until November 6, 2025.
   citedwww.coindesk.com/policy/2025/11/25/upbit…-korea-regulatorwww.amlintelligence.com/2025/02/news-upb…ree-month-users/
2. #15[disputed][awaiting moderator]in the timeline

   “FIU imposes sanctions on Dunamu: a 35.2 billion KRW (~$25M) fine, a disciplinary warning to Dunamu's CEO, and a three-month suspension on new customer deposits, withdrawals, and transfers.”

   reviewerFIU imposes sanctions on Dunamu: a 35.2 billion KRW (~$25M) fine, a disciplinary warning to Dunamu's CEO, and a three-month suspension on new customer deposits, withdrawals, and transfers.Same underlying date conflation as the equivalent claim in sections[5].content.
   Proposed correction (not yet applied)

   FIU imposes a disciplinary warning on Dunamu's CEO and a three-month suspension on new customer deposits, withdrawals, and transfers; the FIU's 35.2 billion KRW (~$25M) fine over the same violations was not imposed until November 6, 2025.
   citedwww.coindesk.com/policy/2025/11/25/upbit…-korea-regulator
3. #18[disputed][awaiting moderator]in section: AML and KYC Violations (2024-2025)

   “A court order in April 2026 partially reversed the customer transfer suspension.”

   reviewerA court order in April 2026 partially reversed the customer transfer suspension.The suspension itself was 'partial' in scope (new customers only), and the court fully cancelled that partial suspension — the page's wording ('partially reversed') reads as the court only partly overturning it, which is not what the sources describe.
   Proposed correction (not yet applied)

   A court order in April 2026 fully cancelled the three-month customer transfer suspension.
   citedcryptobriefing.com/south-korea-dunamu-up…nctions-process/
4. #19[disputed][awaiting moderator]in the timeline

   “A court order partially reverses the FIU's February 2025 customer transfer suspension against Dunamu.”

   reviewerA court order partially reverses the FIU's February 2025 customer transfer suspension against Dunamu.Same underlying mischaracterization as the equivalent claim in sections[5].content.
   Proposed correction (not yet applied)

   A court order fully cancels the FIU's February 2025 customer transfer suspension against Dunamu.
   citedcryptobriefing.com/south-korea-dunamu-up…nctions-process/

No source the reviewer could reach confirms or contradicts the claim.

1. #11[unverifiable][awaiting moderator]in section: Lazarus Group Attribution

   “CertiK observed that the speed and scale of withdrawals were reminiscent of Lazarus-related attacks and tracked over 100 exploiter addresses on the Solana network.”

   reviewerCertiK observed that the speed and scale of withdrawals were reminiscent of Lazarus-related attacks and tracked over 100 exploiter addresses on the Solana network.Could not independently confirm the specific CertiK figure of 'over 100 exploiter addresses' in the sources checked; it may appear in the Halborn research note cited elsewhere on the page, which was not checked for this specific detail.
   citedwww.coindesk.com/markets/2025/11/28/sout…sd36m-upbit-hackwww.dlnews.com/articles/regulation/did-n…crypto-exchange/

The claim was accurate when written but events since have overtaken it.

1. #4[stale][awaiting moderator]in section: Company Overview

   “As of 2025-2026, Upbit holds an estimated 80-90% domestic market share with daily trading volumes frequently exceeding $10 billion.”

   reviewerAs of 2025-2026, Upbit holds an estimated 80-90% domestic market share with daily trading volumes frequently exceeding $10 billion.The 80-90% figure traces to a 2023 report and is presented as current for 2025-2026; multiple later sources (Fortune, 4Pillars/Korea Web3 report, trade press) put 2025-2026 share in the 60-70% range amid a resurgent Bithumb. The daily-volume figure was not independently falsifiable in the time available and is left unchanged.
   Proposed correction (not yet applied)

   As of 2025-2026, Upbit holds an estimated 60-70% domestic market share with daily trading volumes frequently exceeding $10 billion.
   citedreports.tiger-research.com/p/dunamu-upbit-breakdown
2. #6[stale][awaiting moderator]in section: Company Overview

   “Regulatory approvals for the merger remained outstanding as of mid-2026, with the transaction's completion deferred to December 31, 2026.”

   reviewerRegulatory approvals for the merger remained outstanding as of mid-2026, with the transaction's completion deferred to December 31, 2026.December 31, 2026 was briefly the target after a July 2026 revision, but a further delay filed October 7, 2026 — before this review date — pushed completion to March 31, 2027. The date is also inconsistent with the page's own cited Tiger Research source, which lists September 30, 2026.
   Proposed correction (not yet applied)

   Regulatory approvals for the merger remained outstanding as of mid-2026, with the transaction's completion deferred to March 31, 2027.
   citedreports.tiger-research.com/p/dunamu-x-na…rger-delayed-eng

A cited source no longer resolves or no longer says what the page attributes to it.

1. #17[link rot][awaiting moderator]in section: AML and KYC Violations (2024-2025)

   “https://www.amlintelligence.com/2025/02/news-upbit-hit-with-three-month-users/”

   reviewerSource citing the detailed AML/KYC violation breakdown is live and supports the figures.Dead link; it is also the only apparent source for the unverifiable 34,777/5,785 figures discussed above, so removing it (or replacing with a live source that actually carries those numbers) would also resolve that finding.
   citedwww.amlintelligence.com/2025/02/news-upb…ree-month-users/

The cited evidence supports part of the claim but not all of it.

1. #16[partially supported][awaiting moderator]in section: AML and KYC Violations (2024-2025)

   “Regulators identified approximately 34,777 KYC violations, 5,785 cases of incorrect or missing address details, approximately 5.3 million instances of insufficient customer identity verification, 15 unreported suspicious transactions, and 44,948 virtual asset transfers conducted with 19 unregistered foreign service providers.”

   reviewerRegulators identified approximately 34,777 KYC violations, 5,785 cases of incorrect or missing address details, approximately 5.3 million instances of insufficient customer identity verification, 15 unreported suspicious transactions, and 44,948 virtual asset transfers conducted with 19 unregistered foreign service providers.Three of the five cited figures (5.3M, 15, 44,948/19) are independently corroborated. The 34,777 and 5,785 figures rest on a dead link and conflict in scale with other reporting of 500,000-700,000 KYC failures; they could not be verified.
   citedphemex.com/news/article/upbit-faces-25-m…violations-39417www.amlintelligence.com/2025/02/news-upb…ree-month-users/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Company Overview

   “Dunamu was founded in April 2012 by Song Chi-Hyung, who holds degrees in Computer Science and Economics from Seoul National University.”

   reviewerDunamu was founded in April 2012 by Song Chi-Hyung, who holds degrees in Computer Science and Economics from Seoul National University.Core facts (2012 founding, SNU, CS+Economics background) are corroborated by Wikipedia and secondary bios, though sources vary on whether economics was a double major or minor. Not material enough to dispute.
   citedwww.forbes.com/sites/gracechung/2018/02/…y-ether-bitcoin/
2. #2[confirmed][no action needed]in section: Company Overview

   “The company initially operated as a financial news aggregator before pivoting to crypto exchange services.”

   reviewerThe company initially operated as a financial news aggregator before pivoting to crypto exchange services.Corroborated by two independent secondary sources.
   citedreports.tiger-research.com/p/dunamu-upbit-breakdown
3. #3[confirmed][no action needed]in section: Company Overview

   “Upbit launched on October 24, 2017, in partnership with American exchange Bittrex, and within months became South Korea's largest cryptocurrency exchange.”

   reviewerUpbit launched on October 24, 2017, in partnership with American exchange Bittrex, and within months became South Korea's largest cryptocurrency exchange.Matches independent sourcing.
   citedreports.tiger-research.com/p/dunamu-upbit-breakdown
4. #5[confirmed][no action needed]in section: Company Overview

   “In November 2025, Dunamu entered a merger agreement with Naver Financial, a subsidiary of Naver Corporation — South Korea's dominant internet portal company — in a deal that would further consolidate Dunamu's position in the Korean fintech ecosystem.”

   reviewerIn November 2025, Dunamu entered a merger agreement with Naver Financial.Confirmed.
   citedreports.tiger-research.com/p/dunamu-x-na…rger-delayed-eng
5. #7[confirmed][no action needed]in section: November 2025 Hot Wallet Breach

   “On November 27, 2025 — the same date as Upbit's 2019 hack and coinciding with a Naver Financial merger-related corporate event — attackers drained Upbit's Solana hot wallet beginning at approximately 4:42 a.m. Korea Standard Time.”

   reviewerOn November 27, 2025, attackers drained Upbit's Solana hot wallet beginning at approximately 4:42 a.m. KST, lasting roughly 54 minutes, with total losses of 44.5-54 billion KRW (approximately $30-36 million).Date, time window, and loss range are corroborated by multiple independent reports; the 2019/2025 same-calendar-date coincidence checks out (both Nov. 27).
   citedwww.coindesk.com/markets/2025/11/28/sout…sd36m-upbit-hackwww.theblock.co/post/408848/upbit-parent…lion-hack-report
6. #8[confirmed][no action needed]in section: November 2025 Hot Wallet Breach

   “Dunamu subsequently recovered approximately 2.6 billion KRW through freezing procedures and compensated the remaining approximately 38.6 billion KRW in user losses from its own operational reserves.”

   reviewerDunamu subsequently recovered approximately 2.6 billion KRW through freezing procedures and compensated the remaining approximately 38.6 billion KRW in user losses from its own operational reserves.Figures confirmed; exact February 2026 dating in the timeline could not be independently pinned down but is plausible and not contradicted.
   citedwww.theblock.co/post/408848/upbit-parent…lion-hack-report
7. #9[confirmed][no action needed]in section: November 2025 Hot Wallet Breach

   “This marked Upbit's second significant hot wallet breach in six years, the first having occurred in November 2019 when approximately 342,000 ETH worth roughly 58 billion KRW was stolen.”

   reviewerThis marked Upbit's second significant hot wallet breach in six years, the first having occurred in November 2019 when approximately 342,000 ETH worth roughly 58 billion KRW was stolen.Confirmed by multiple independent 2019-era and later retrospective sources.
   citeddig.watch/updates/south-korea-identifies…n-50m-upbit-hack
8. #10[confirmed][no action needed]in section: Lazarus Group Attribution

   “The Yonhap news agency reported that authorities cited tactical similarities to the 2019 Upbit breach, including alleged hijacking or impersonation of administrator credentials previously associated with Lazarus operations.”

   reviewerSouth Korean authorities and multiple security firms have attributed the November 2025 breach to North Korea's Lazarus Group, with tactics including hijacking/impersonation of admin credentials and mixing techniques for laundering.The page's hedged framing ('attributed... though definitive on-chain proof had not been publicly confirmed') matches the cited source's own hedging.
   citedwww.coindesk.com/markets/2025/11/28/sout…sd36m-upbit-hack
9. #12[confirmed][no action needed]in section: FSS Sanction Proceedings (July 2026)

   “On July 19, 2026 — approximately eight months after the November 2025 breach — the Financial Supervisory Service (FSS) issued a formal inspection opinion letter to Dunamu, opening a multi-stage sanction process.”

   reviewerOn July 19, 2026, the FSS issued a formal inspection opinion letter to Dunamu, opening a multi-stage sanction process over the November 2025 hack.Confirmed, including the multi-stage escalation path described.
   citedwww.theblock.co/post/408848/upbit-parent…lion-hack-report
10. #13[confirmed][no action needed]in section: AML and KYC Violations (2024-2025)

    “In January 2025, the FIU issued a preliminary notice of sanctions.”

    reviewerIn January 2025, the FIU issued a preliminary notice of sanctions against Dunamu.Confirmed, including the specific January 9 date used in the timeline.
    citedcryptobriefing.com/upbit-sanctions-over-aml-kyc/
11. #20[confirmed][no action needed]in section: BonkDAO Governance Attack and Upbit BONK Suspension (July 2026)

    “On July 7, 2026, BonkDAO — the governance body for the BONK token on Solana — suffered a governance attack in which a malicious proposal (Bonk Improvement Proposal #76, titled 'Sowellian BonkDAO') was passed using accumulated voting power, draining approximately $20 million in BONK tokens from the treasury.”

    reviewerOn July 7, 2026, BonkDAO suffered a governance attack via malicious proposal BIP #76, draining approximately $20 million in BONK; the BONK price fell approximately 9%; Upbit suspended BONK deposits/withdrawals citing a security incident.All core details confirmed directly against the cited credibility-1 source.
    citedwww.theblock.co/post/407343/bonkdao-lose…-proposal-attack
12. #21[confirmed][no action needed]in section: FSS Sanction Proceedings (July 2026)

    “FSS Governor Lee Chan-jin acknowledged this gap at a December 2025 press conference, stating that the act does not provide sufficient legal grounds to hold service providers fully accountable for such incidents.”

    reviewerSouth Korea's Virtual Asset User Protection Act, enacted in its first phase in July 2024, does not contain direct penalty provisions for hacking incidents or computer system breaches; FSS Governor Lee Chan-jin acknowledged this gap at a December 2025 press conference.Confirmed by two independent Korean outlets.
    citedcoinlaw.io/fss-sanctions-dunamu-upbit-hack/