---
title: "Korea opens a sanctions process against Upbit's operator over a $36 million hack"
description: "The Financial Supervisory Service has sent Dunamu an inspection opinion letter, the formal first step toward penalties over a November breach that drained $36 million in 54 minutes. No penalty has been set, and the law the regulator is working under has no direct sanctions provision for hacks."
category: "Crypto"
category_url: https://boursel.com/category/crypto
author: "Priya Venkatesan"
published: 2026-07-19T10:56:00.000Z
updated: 2026-07-19T10:56:00.000Z
canonical: https://boursel.com/article/korea-opens-a-sanctions-process-against-upbits-operator-over-a-36-million-hack
tags: ["upbit", "dunamu", "south-korea", "crypto-regulation", "exchange-security"]
---
# Korea opens a sanctions process against Upbit's operator over a $36 million hack

The Financial Supervisory Service has sent Dunamu an inspection opinion letter, the formal first step toward penalties over a November breach that drained $36 million in 54 minutes. No penalty has been set, and the law the regulator is working under has no direct sanctions provision for hacks.

South Korea's Financial Supervisory Service has sent an inspection opinion
letter to Dunamu, the operator of the country's dominant crypto exchange Upbit,
[according to
Cointelegraph](https://cointelegraph.com/news/south-korean-regulator-inspection-letter-upbit-36m-hack).
The letter is the formal start of a sanctions procedure over a hack that took
place last November.

The distinction matters and is easy to lose. This is the opening of a process,
not a penalty. The letter gives Dunamu the opportunity to respond to the
regulator's findings and contest them before any proposed sanction is set. No
fine has been announced and none may be.

## What happened in November

The breach occurred on November 27, 2025. Attackers drained roughly $36 million
from one of Upbit's hot wallets, the internet-connected wallets exchanges use to
process withdrawals, over a window of about 54 minutes beginning at 4:42 a.m.
Korean time.

The distinction between hot and cold storage is central to how these incidents
happen. Cold wallets are kept offline and are effectively unreachable remotely,
but funds in them cannot be moved quickly. Hot wallets are online so customers
can withdraw on demand, which is exactly what makes them the target. Every
exchange runs a balance between the two, and that balance is what regulators
scrutinise after a theft.

Upbit reimbursed affected customers in full from its own balance sheet, froze
roughly 2.3 billion won, about $1.5 million, of the stolen funds, upgraded its
wallet architecture and launched an on-chain tracing system in December to
follow the money.

## The disclosure timing drew the criticism

The part that attracted the most scrutiny was not the theft but the
announcement. Upbit disclosed the hack at the end of the day, after a Naver
Financial merger event had concluded.

That sequencing is the kind of thing regulators tend to take seriously,
independently of the security failure itself. A listed or soon-to-be-consolidated
financial firm choosing when to reveal a material incident touches disclosure
obligations rather than cybersecurity rules, and it is often the easier thing
for an authority to act on.

## The regulator has a legal problem

There is an awkwardness at the centre of this case. Korea's Virtual Asset User
Protection Act, the law that brought exchanges under supervision, contains no
direct sanctions provisions for cyberattacks or hacks.

That leaves the FSS working through adjacent obligations, such as internal
controls, risk management and disclosure, rather than a rule that says an
exchange is liable for being breached. Korean authorities plan to address the
gap in a second phase of the Digital Asset Basic Act.

This is not unique to Korea. Most crypto regulation written in the past few
years focused on the failures regulators had already seen, meaning custody of
customer assets, reserve backing and market conduct. Theft by external attackers
sits awkwardly in that framework, because the exchange is simultaneously the
victim and the party with the duty to prevent it.

## Why Upbit specifically matters

Upbit is not a marginal venue. It ranks third among crypto spot exchanges
globally by trading volume, and it dominates its home market, which is one of
the most retail-heavy crypto markets in the world.

That concentration is the systemic argument for tighter supervision. In a market
where a single exchange handles a large share of national trading, an outage,
insolvency or successful attack is not an isolated commercial failure but an
event affecting a substantial share of the country's retail investors at once.

It also explains why the process now beginning is worth watching beyond Korea.
Regulators elsewhere are wrestling with the same question: what an exchange owes
its customers when it is robbed, and whether reimbursing them in full, as Upbit
did, is a mitigating factor or simply the baseline expectation.

## Sources

- [South Korean regulator begins sanctions process against Dunamu](https://cointelegraph.com/news/south-korean-regulator-inspection-letter-upbit-36m-hack)