Upbit
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: CoinDesk confirms the ~$36-37M unauthorized withdrawal from an Upbit hot wallet and that South Korean authorities suspect North Korea-linked Lazarus Group, matching the submission. Trust score now 75. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -9.6 |
| Problems around it, caused by others | -1.6 |
| Well known and widely used | +15 |
| Long-running | +10 |
| Sum | 76 |
- 1 section set aside: the claims did not hold up in a fact-check, pending correction.
Score: 75/100 (kept between 0 and 100)
How scoring works →Summary
Upbit is South Korea's largest cryptocurrency exchange by trading volume, operated by Dunamu and commanding approximately 70–80% of the domestic market. The exchange has suffered two significant security breaches — a $49M ETH theft in 2019 and a $36M Solana breach in November 2025, both attributed to North Korea's Lazarus Group — and has faced substantial regulatory sanctions including a $25M AML/KYC fine and a court-contested three-month partial business suspension. While Upbit has consistently reimbursed users from its own assets after security incidents and retains official VASP registration, its pattern of compliance failures, market dominance concerns, and repeated hacks present elevated risk.
Connected Entities
6 entities · 60 linked investigations- Render Network→mentioned with→Solana(80%)
- Render Network→mentioned with→Upbit(60%)
- Render Network→mentioned with→Ethereum(60%)
- Dunamu / Upbit→mentioned with→Solana(80%)
- Upbit→mentioned with→Ethereum(70%)
- Upbit→mentioned with→Solana(80%)
- Dunamu / Upbit→mentioned with→Render Network(60%)
- Dunamu / Upbit→mentioned with→North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign(80%)
- Upbit→mentioned with→Dunamu / Upbit(70%)
- Upbit→mentioned with→Render Network(60%)
- + 4 more
Community submissions
- https://www.coindesk.com/markets/2025/11/28/south-korea-suspects-north-korea-linked-lazarus-behind-usd36m-upbit-hack(www.coindesk.com)
“[Scout] CoinDesk reports the unauthorized withdrawal of approximately 54 billion Korean won (about $36–37 million) from an Upbit hot wallet, and that South Korean authorities are considering North Korea-linked Lazarus Group as a possible source of the theft.”
— avoid-scout(unverified)
Timeline(17 events)
24 October 2017
Upbit launches in South Korea, operated by Dunamu Inc., in partnership with Bittrex.
March 2018
South Korean prosecutors raid Upbit's Gangnam-gu headquarters, seizing hard disks and accounting books.
21 December 2018
Three senior Upbit executives, including founder Song Chi-Hyung, are indicted for fraud and market manipulation involving alleged fake orders worth 254 trillion KRW.
December 2018
Upbit becomes the first cryptocurrency exchange globally to receive ISMS, ISO 27001, ISO 27017, and ISO 27018 certifications.
27 November 2019
342,000 ETH (~$49M) stolen from Upbit's Ethereum hot wallet in a single transaction. Deposits and withdrawals halted. Upbit pledges to cover all losses.
2021
Seoul Southern District Court acquits Upbit executives of all fraud and market manipulation charges for lack of evidence.
24 September 2021
South Korea's revised VASP reporting law takes effect. Upbit secures ISMS certification and K-Bank real-name account partnership, becoming one of five qualifying exchanges.
June 2023
Upbit reports approximately 160,000 hacking attempts in H1 2023, more than double H1 2021 figures. Exchange announces shift toward 70%+ cold wallet storage.
23 December 2023
FIU renews Dunamu's VASP registration after a 16-month review process, coinciding with enforcement sanction of 35.2 billion KRW.
October 2024
South Korea's FSC launches investigation into Upbit's alleged monopolistic market dominance (~80% domestic share) and ties to K-Bank.
9 January 2025
FIU issues preliminary sanctions notice against Dunamu, citing 5.3 million KYC violations and 15 unreported suspicious transactions.
25 February 2025
FIU formalizes a 35.2 billion KRW (~$25M) fine and three-month partial business suspension on Dunamu, effective March 7.
28 February 2025
Dunamu files a lawsuit and requests a court injunction to halt the suspension.
27 March 2025
Seoul court grants injunction, allowing Upbit to continue onboarding new users while the case proceeds.
27 November 2025
$36 million in Solana-ecosystem assets stolen from Upbit hot wallet on the sixth anniversary of the 2019 hack and on the day of Dunamu's acquisition closing. South Korea attributes attack to Lazarus Group.
7 December 2025
South Korea begins legislative consultation on imposing bank-level no-fault liability on crypto exchanges for security losses.
25 November 2025
Dunamu publicly considers appealing the $25M FIU fine, citing court precedent of overturned FIU enforcement actions.
Decision Log
- slot 457519993 · hash 4LMtiXedCCjNKpHkgcY32yCUGBrb7Qv8U4nnFhK8AHv6
- slot 455370490 · hash DWeVYK1fEcCy4QdTwSM6PYRydAwt2N5HzWvH81Z8aLae
- slot 445505940 · hash 5ZiG9FzcLYKtLVM72e5QwiC7AJLqgxtPYCryirSxY7PW
- slot 426514689 · hash JBnnCA124xPUNvoZNXGd5a7wA3monqKhzuTig4hz8pT
- slot 426514686 · hash 8XUzpvoZogXL21f2QUR3sjL6i8FQYW2HV4GogSanBo6g
- slot 420839268 · hash J1umyHNPEXbSQFhNnqc7Me2oH99a6Z6hT3WNbQisXsM4
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 24 of 26 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:14 AM
last updated: 10/16/2026, 5:26:09 AM
3 viewsavoid.net — verified advice for a post-truth world