Chandra Wibowo
South Korea’s primary financial regulator, the Financial Supervisory Service (FSS), has formally initiated a sanctions procedure against Dunamu, the operator of the prominent cryptocurrency exchange Upbit, in response to a significant $36 million hack that occurred in November 2025. The FSS has reportedly dispatched an inspection opinion letter to Dunamu, signaling the commencement of a formal review of the exchange’s handling of the security breach. This development marks a critical juncture in the regulatory oversight of virtual asset service providers in South Korea, highlighting the authorities’ increasing scrutiny following major security incidents.
The inspection opinion letter, a procedural step in South Korea’s regulatory framework, provides Dunamu with a crucial opportunity to present its case and respond to the findings of the FSS’s investigation. Before the regulator formally notifies the company of any proposed sanctions, this period allows Dunamu to offer explanations, present mitigating factors, and potentially contest aspects of the inspection’s conclusions. This process underscores the principle of due process within the regulatory system, ensuring that entities have a chance to defend their actions before penalties are imposed.
Background of the November 2025 Hack
The incident that triggered this regulatory action involved a substantial loss of cryptocurrency from Upbit’s hot wallet. On November 27, 2025, at approximately 4:42 AM Korean Standard Time (KST), an unauthorized party gained access to a portion of Upbit’s digital assets, resulting in the theft of approximately $36 million worth of cryptocurrency. The breach, which lasted for about 54 minutes, went undetected or unreported by Upbit for several hours.
Delayed Disclosure Sparks Criticism
A significant point of contention surrounding the hack has been Upbit’s delayed public announcement. According to local news outlet Yonhap News, Upbit faced considerable criticism for its protracted disclosure of the security breach. The exchange only officially announced the hack at the end of the day on November 27th, notably after a significant merger-related event involving internet giant Naver Financial had concluded. This timing led to accusations that Upbit may have intentionally withheld information to avoid disrupting corporate activities or causing undue panic among its user base. The FSS is reportedly scrutinizing this delay as part of its investigation into whether Upbit violated the Virtual Asset User Protection Act.
Regulatory Framework and the Path Forward
The FSS’s review is centered on whether Upbit’s actions and the security measures in place at the time of the hack complied with existing regulations. The Virtual Asset User Protection Act, while providing a framework for user protection, reportedly lacks specific, direct sanctions provisions pertaining to cyberattacks or computer system breaches. This regulatory gap has been acknowledged by South Korean authorities, who are reportedly planning to address it through the upcoming Digital Asset Basic Act. This foundational legislation, expected to be implemented in phases, is intended to introduce robust sanctions and compensation provisions for hacking incidents and other computer system failures within the digital asset ecosystem. The current FSS action, therefore, represents an interim measure to address the immediate fallout of the Upbit hack while longer-term legislative solutions are being developed.
Upbit’s Response and Mitigation Efforts
Following the hack, Upbit swiftly moved to mitigate the financial impact on its users. In a public statement issued after the exploit, the exchange announced that it had frozen approximately 2.3 billion won (equivalent to about $1.5 million) worth of funds in an attempt to contain the stolen assets. Crucially, Upbit committed to fully reimbursing all affected customers, a pledge that would be fulfilled using the exchange’s own balance sheet assets, demonstrating a significant financial commitment to its user base.
In the aftermath of the breach, Upbit also initiated a comprehensive overhaul of its cryptocurrency wallet architecture. This proactive measure aimed to identify and address potential vulnerabilities that may have been exploited. The exchange confirmed that all assets from affected wallets were migrated to more secure infrastructure.
Further demonstrating its commitment to security and recovery, Upbit announced in December 2025 the development of an automatic on-chain tracing system, dubbed the "Onchain AI Tracer System." This innovative tool is designed to track the movement of stolen funds across the blockchain, thereby aiding potential recovery efforts and providing greater transparency into illicit financial activities within the crypto space.
Broader Implications for the South Korean Crypto Market
The FSS’s formal initiation of sanctions against Dunamu carries significant implications for the broader South Korean cryptocurrency market. As one of the largest exchanges in the country, Upbit’s security posture and regulatory compliance are closely watched by both users and other market participants. This regulatory action underscores the FSS’s commitment to ensuring a secure and trustworthy environment for virtual asset trading.
The incident and the subsequent regulatory response highlight the ongoing challenges faced by cryptocurrency exchanges in safeguarding digital assets against sophisticated cyber threats. The FSS’s focus on the Virtual Asset User Protection Act, despite its limitations regarding cyberattacks, signals a regulatory intent to hold exchanges accountable for security lapses. The planned inclusion of specific sanctions in the Digital Asset Basic Act will likely set a new benchmark for security standards and incident response protocols for all virtual asset service providers operating in South Korea.
Furthermore, the delay in Upbit’s announcement raises important questions about transparency and corporate responsibility in crisis management. Regulators will likely scrutinize such delays more closely in the future, potentially leading to stricter disclosure requirements for exchanges during security incidents.
Upbit’s Market Position
Upbit, as of its current standing, holds a significant position in the global cryptocurrency exchange landscape. It ranks third on CoinMarketCap’s cryptocurrency spot exchange rankings. This ranking is based on a comprehensive scoring system that considers various metrics, including website traffic, liquidity, and trading volumes. Its prominent position underscores its importance to the South Korean and global crypto markets, making its regulatory compliance and security practices a matter of considerable interest.
The ongoing FSS investigation and the potential sanctions represent a critical period for Dunamu and Upbit. The outcome of this process will not only shape the immediate future of the exchange but also contribute to the evolving regulatory framework governing digital assets in South Korea, aiming to enhance investor protection and market integrity in the rapidly advancing digital economy. The industry will be closely observing how Upbit responds to the FSS’s opinion letter and what measures are ultimately imposed, as these developments could set precedents for future regulatory actions and industry best practices.
