Trusted editorial content reviewed by leading industry experts and experienced editors. Ad Disclosure
Upbit, one in all South Korea's largest crypto exchanges, reported a big loss after a hot wallet on the Solana network was prematurely emptied on November 27, 2025.
About 54 billion Korean won – about $36 million to $37 million – was reportedly withdrawn in an “abnormal withdrawal” detected by the corporate at 4:42 a.m. KST.
Upbit is discontinuing Solana services
According to the exchange, deposits and withdrawals of assets on the Solana chain were stopped immediately after the breach was discovered.
The company's engineers have moved the remaining Solana inventory into cold storage to limit further access. Some tokens were later frozen on-chain while investigators tracked the transfers.
According to reports, roughly 12 billion won (roughly $8 million to $9 million) in LAYER tokens have been frozen to date.
NEW: UPBIT DISCLOSES Approximately $37 Million in Hacking Attack on Solana Network – “TO PREVENT DAMAGE TO MEMBERS' ASSETS, THE ENTIRE AMOUNT WILL BE COVERED BY UPBIT'S STOCKHOLDINGS. WE WOULD LIKE TO REPEAT THAT THIS WILL NOT IMPACT MEMBERS' ASSETS WILL.”
SOURCE: https://t.co/LaGePSDOj4 pic.twitter.com/JRQzOFX2ot
– DEGEN NEWS (@DegenerateNews) November 27, 2025
A big selection of tokens look like affected
According to reports from blockchain trackers and media outlets, the stolen assets included SOL and USDC, in addition to many Solana ecosystem tokens.
The stolen tickers reportedly include ACS, BONK, RAY, JUP, PYTH, ORCA, JTO, LAYER, RENDER, MOODENG, and TRUMP, amongst others.
The list is long and the tracking continues as some tokens move through multiple wallets. Several addresses where the funds are situated are currently being actively monitored.
Upbit(@Official_Upbit) was hacked – 54 billion KRW (~36.8 million USD) of assets on #Solana were transferred to unknown wallets.https://t.co/plbmBz2G4Nhttps://t.co/YOHoqDVfqa pic.twitter.com/DM5BxSTtXA
– Lookonchain (@lookonchain) November 27, 2025
Exchange operator guarantees coverage
Dunamu, Upbit's parent company, has stated that the exchange will cover all the loss from its own reserves, so customer balances is not going to be reduced.
According to the corporate, this decision was made to guard users in the course of the technical and forensic review.
A security review of deposit and withdrawal systems has been initiated and out of doors experts are reported to be assisting within the investigation.
Solana’s market cap is currently $79.38 billion. Chart: TradingView
Past incidents and the timing raise questions
The timing was reportedly bad: the breach occurred immediately after a high-profile corporate announcement involving Naver Financial on November 26, 2025.
Upbit is not any stranger to major hacks; An attack in 2019 cost the platform a considerable amount of ETH. Hot wallets connected to the web remain a known vulnerability of centralized exchanges. This risk became clear again here.
Hopes for on-chain tracking and recovery
Blockchain analysts track transfers and discover the wallets that received funds. Some tokens could also be frozen if their issuers or government authorities cooperate. This is how the reported LAYER freeze was achieved.
Still, many assets might be difficult to recuperate and the legal process might be slow. It was reported that the exchange tried to freeze as much as possible while moving other assets offline.
What this implies for users and market confidence
For now, Upbit users can rest assured that their funds are protected because the operator has promised to cover the loss.
Market reactions could include temporary liquidity issues for certain Solana tokens listed on the platform while services remain limited.
Featured image from Pixabay, chart from TradingView
Editorial process At Bitcoinist, the main target is on providing thoroughly researched, accurate, and unbiased content. We maintain strict sourcing standards and each page is fastidiously reviewed by our team of top technology experts and experienced editors. This process ensures the integrity, relevance and value of our content to our readers.
