Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected
Upbit exchange Solana hot wallet
On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing.
Why this severity: $36M reported stolen.
- Started
- Nov 27, 2025
- Closed
- Nov 27, 2025
- Chains
- Solana
- Reported stolen
- $36M
At risk
- Upbit exchange Solana hot wallet
- Solana wallets
What to do now
- Check announcements only inside the Upbit app or on its official site.
- Ignore texts, emails or DMs offering 'refunds' or 'compensation' links. Upbit has no reason to ask for your login or seed phrase.
- Expect Solana deposits and withdrawals to pause while incidents like this are investigated. Don't send funds to any 'temporary' address you are given.
Stay safe
Am I affected?
Only Upbit's own hot wallet was drained. Upbit said it would cover losses from its reserves and that cold wallets were untouched. If you had Solana tokens on Upbit, your exchange balance should not have changed.
What to do now
- Check announcements only inside the Upbit app or on its official site.
- Ignore texts, emails or DMs offering 'refunds' or 'compensation' links. Upbit has no reason to ask for your login or seed phrase.
- Expect Solana deposits and withdrawals to pause while incidents like this are investigated. Don't send funds to any 'temporary' address you are given.
How to avoid this
- Keep long-term holdings in self-custody (a hardware wallet) rather than on an exchange hot wallet.
- Spread large balances across custodians.
- After exchange hacks, scammers impersonate support. Only use support links you reach yourself.
Timeline 2
Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.
SourceUpbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.
Source
News & write-ups ›1
Follow new drains and updates in your feed reader or Telegram RSS bot.