Upbit Suffers 44.5 Billion KRW Hack Suspected to Involve Lazarus Group

Upbit Suffers 44.5 Billion KRW Hack Suspected to Involve Lazarus Group

Upbit lost $4M of its own funds in a 44.5 billion won breach, reimbursing all customer losses and freezing assets as authorities investigate possible Lazarus Group involvement.

SOL

Fact Check
The statement is overwhelmingly supported by a consensus of high-authority primary sources. Major South Korean newspapers (Asia Business Daily, The Chosun Ilbo), international financial news outlets (Yahoo Finance), and a specialized blockchain security firm (SlowMist) all confirm that the cryptocurrency exchange Upbit was the victim of a major hack.The reported loss amount is highly consistent across these sources, hovering around the 54 billion KRW figure. Reports cite amounts such as "54 billion KRW," "approximately 54 billion KRW," "$36 Million" (which converts to a similar KRW value), and "roughly 58 billion won." This slight variation is expected in reporting on fluctuating crypto assets and does not challenge the core claim. For example, reports referencing a 2019 hack mention a loss of 342,000 ETH, with KRW/USD valuations at the time placing the loss in the 50-58 billion KRW range.There is a minor inconsistency in the sources regarding the specific asset stolen (some mention Ethereum in a 2019 hack, while others cite Solana in a more recent event). However, this does not invalidate the user's general statement, which does not specify an asset or a date. The evidence strongly confirms that an event matching the statement's description—a hack of Upbit resulting in a loss of approximately 54 billion KRW—did occur. The combined weight and credibility of the corroborating sources make the statement highly likely to be true.
Summary

Upbit, South Korea’s largest cryptocurrency exchange, reported a 44.5 billion won ($33M) hack on Thursday, including 5.9 billion won ($4M) of its own funds. Parent company Dunamu’s CEO Oh Kyung-seok confirmed all 38.6 billion won in customer losses were reimbursed from reserve funds, and 2.3 billion won was frozen via blockchain tracking. Deposits and withdrawals were suspended immediately after detecting the breach. Authorities suspect North Korea-linked Lazarus Group as potential perpetrators, drawing parallels to their previous attacks. The incident adds to Upbit’s history of high-profile hacks, including a major Solana hot wallet compromise earlier in 2025.

Terms & Concepts
  • Lazarus Group: A hacking group linked to North Korea known for cyberattacks targeting financial institutions and cryptocurrency exchanges.
  • Hot Wallet: A cryptocurrency wallet connected to the internet, offering convenience for transactions but greater vulnerability to hacks.
  • Blockchain Tracking: The process of monitoring and analyzing cryptocurrency transactions on the blockchain to trace stolen funds or illicit activity.
Tweets13