South Korea Begins Sanction Process Against Upbit Operator Over $30 Million Hack

South Korea’s Financial Supervisory Service has formally begun sanction proceedings against Dunamu, the company behind crypto exchange Upbit, following the roughly $30 million hack the platform suffered last November. According to local broadcaster, the regulator recently sent Dunamu an inspection report covering the incident, marking the first official step in the sanction process, which comes about seven months after the investigation originally began.

Hack Drained Funds in Under an Hour

Upbit, South Korea’s largest crypto exchange by trading volume, lost approximately 44.5 billion won in Solana-based assets during the November breach. Funds were transferred to an external wallet over roughly 54 minutes starting in the early morning hours. Dunamu covered the vast majority of affected customer funds using its own reserves and has since frozen a portion of the stolen assets while continuing recovery efforts, though the frozen amount still represents only a small fraction of the total loss.

Disclosure Timing Drew Criticism

The exchange faced criticism at the time for waiting to announce the breach until after a merger event with a major financial technology partner had concluded that same day. That merger, a stock-swap deal, remains pending and was recently delayed further, meaning the sanction process will now unfold while the deal is still awaiting completion.

Legal Gaps Create Uncertainty Around Penalties

Regulators have been examining whether the breach involved violations of South Korea’s Virtual Asset User Protection Act, though that law primarily addresses user protection and unfair trading practices rather than establishing direct penalties for hacking incidents or system failures. This gap leaves the eventual scope of any sanctions unclear. Authorities have indicated plans to address this shortfall through a second phase of crypto legislation that would introduce specific rules covering sanctions and compensation related to hacking and IT failures.

Formal Sanctions Still Pending Multiple Reviews

The regulator plans to notify Dunamu of a proposed sanction level following a clarification process, with final penalties ultimately determined through review by multiple regulatory bodies. Authorities have previously suspected a North Korean hacking group of being responsible for the theft, though this has not been officially confirmed by either Upbit or regulators. Separately, the FSS has also completed a related inspection into rival exchange Bithumb over a different incident and plans to begin its own sanction procedures there once legal reviews are finalized. The regulator will pause its broader inspection activities for three weeks before resuming in mid-August.