{
 "tag": "cex",
 "name": "CEX",
 "group": "Other",
 "incidents": [
  {
   "slug": "upbit-solana-hot-wallet-hack-nov-2025",
   "title": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025",
   "json": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": null,
   "product": "Upbit exchange Solana hot wallet",
   "tags": [
    "solana",
    "exchange",
    "cex",
    "hot-wallet",
    "upbit",
    "lazarus",
    "north-korea"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2025-11-27",
   "closedAt": "2025-11-27",
   "updatedAt": "2025-11-28T12:00:00Z",
   "summary": "On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing."
  }
 ],
 "changes": [
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-28",
   "title": "Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-27",
   "title": "Upbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  }
 ]
}