South Korea Opens Sanctions Process Against Dunamu over Upbit Hack

The notice, which sets out the regulator's provisional findings and gives the company a chance to respond, was delivered recently, about seven months after the FSS began its examination, according to financial industry and regulatory officials cited by Yonhap on Sunday.

Upbit lost Solana-based assets to external wallets over a 54-minute window on 27 Nov 2025. Of the 44.5bn won ($30.1mn) that left the exchange, about 87% represented customer holdings, and Dunamu covered those losses in full from its own balance sheet. It had frozen about 6% of the outflow by December.

Dunamu and the FSS both declined to discuss the reported notice when contacted by Sandmark.

Law has no hacking clause

The FSS has been examining whether Dunamu breached the Virtual Asset User Protection Act. The law does not treat a hack as a violation in itself, so the FSS would have to find that the exchange breached a specific duty.

Upbit held more than 90% of customer assets in cold wallets, above the 80% floor set by law, and the theft hit the hot wallets holding the rest, so authorities said they would instead look at whether Upbit did enough to safeguard customer assets and whether it reported the incident properly.

FSS Governor Lee Chan-jin set out the constraint at a press conference late last year. The agency had opened its examination immediately, he said, but what regulators can impose on the crypto sector is limited under the current law. A security breach was still "not something that can simply be passed over," he added, saying the gaps would be taken up in the follow-up legislation.

Response comes before penalty

Dunamu will have a chance to respond before the FSS sets out its proposed penalty. Any measure would then need approval from the Financial Services Commission before taking effect.

The regulator has also completed its examination of Bithumb, the country's second-largest exchange, regarding a bitcoin misallocation incident and will open a sanctions process once its legal review concludes.

Enforcement meets legal resistance

Any penalty is likely to be contested. Korean exchanges have spent the past year challenging regulatory action in court, and so far with some success.

Dunamu won at first instance against the Financial Intelligence Unit (FIU) over a business suspension order tied to alleged breaches of anti-money laundering rules. The court held that such an order requires intent or gross negligence, and found that the regulator had not established either, as it had issued no concrete compliance standard. The FIU has appealed.

Bithumb, which won a court reprieve suspending its own six-month partial ban pending judgment, and was separately fined 36.8bn won ($24.9mn), and Coinone, another exchange in the country, given a three-month partial suspension and a 5.2bn won ($3.5mn) fine, are running similar arguments. In both cases, the court has suspended the business restrictions pending judgment, and first hearings are set for 13 Aug and 16 Sept respectively.

The sanctions process also lands while Naver Financial's all-share takeover of Dunamu awaits clearance. The share exchange has been put back twice, most recently to 31 Dec, with the shareholder vote moved to 19 Nov.