{
 "slug": "upbit-solana-hot-wallet-hack-nov-2025",
 "title": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
 "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025",
 "json": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "solana"
 ],
 "method": null,
 "product": "Upbit exchange Solana hot wallet",
 "tags": [
  "solana",
  "exchange",
  "cex",
  "hot-wallet",
  "upbit",
  "lazarus",
  "north-korea"
 ],
 "amountUsd": 36000000,
 "victims": null,
 "startedAt": "2025-11-27",
 "closedAt": "2025-11-27",
 "updatedAt": "2025-11-28T12:00:00Z",
 "summary": "On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing.",
 "timeline": [
  {
   "date": "2025-11-27",
   "title": "Upbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe"
  },
  {
   "date": "2025-11-28",
   "title": "Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Upbit Hack Attributed to North Korea's Lazarus as Seoul Opens Probe: Report",
   "url": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "publisher": "Decrypt",
   "date": "2025-11-28"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nOnly Upbit's own hot wallet was drained. Upbit said it would cover losses from its reserves and that cold wallets were untouched. If you had Solana tokens on Upbit, your exchange balance should not have changed.\n\n## What to do now\n- Check announcements only inside the Upbit app or on its official site.\n- Ignore texts, emails or DMs offering 'refunds' or 'compensation' links. Upbit has no reason to ask for your login or seed phrase.\n- Expect Solana deposits and withdrawals to pause while incidents like this are investigated. Don't send funds to any 'temporary' address you are given.\n\n## How to avoid this\n- Keep long-term holdings in self-custody (a hardware wallet) rather than on an exchange hot wallet.\n- Spread large balances across custodians.\n- After exchange hacks, scammers impersonate support. Only use support links you reach yourself.",
 "notes": null,
 "agentBrief": "# Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Solana\n- Started: Nov 27, 2025 · Last update: Nov 28, 2025 · Reported stolen: $36M\n- Who/what: Upbit exchange Solana hot wallet\n\nOn Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing.\n\n## Am I affected?\nOnly Upbit's own hot wallet was drained. Upbit said it would cover losses from its reserves and that cold wallets were untouched. If you had Solana tokens on Upbit, your exchange balance should not have changed.\n\n## What to do now\n- Check announcements only inside the Upbit app or on its official site.\n- Ignore texts, emails or DMs offering 'refunds' or 'compensation' links. Upbit has no reason to ask for your login or seed phrase.\n- Expect Solana deposits and withdrawals to pause while incidents like this are investigated. Don't send funds to any 'temporary' address you are given.\n\n## How to avoid this\n- Keep long-term holdings in self-custody (a hardware wallet) rather than on an exchange hot wallet.\n- Spread large balances across custodians.\n- After exchange hacks, scammers impersonate support. Only use support links you reach yourself.\n\n## Sources\n- Upbit Hack Attributed to North Korea's Lazarus as Seoul Opens Probe: Report (Decrypt, 2025-11-28): https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe\n\nFull record: https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025 · JSON: https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}