South Korean authorities are delving into the recent cyberattack on the Upbit cryptocurrency exchange, where a staggering $30.2 million was stolen in less than an hour on November 27. Criticism has mounted as Upbit reportedly informed financial regulators over six hours after the breach, as noted by the South Korean newspaper Chosun Ilbo. Some media outlets speculate that this delay was intended to avoid overshadowing a significant merger announcement by Upbit's operator, Dunamu, with tech giant Naver.
According to a report from the Financial Supervisory Service (FSS), Upbit officials detected the breach at 5 am and held an emergency meeting within 18 minutes. Subsequently, they suspended cryptoasset transactions on the Solana network 27 minutes later and halted all deposits and withdrawals by 8:55 am. However, the first report to the FSS was not made until 10:58 am, raising concerns about the timeliness of their response.
The exact details of the November 27 events remain murky, and while some criticize the delayed response, they doubt that serious repercussions for Upbit will follow, even if irregularities are uncovered. The FSS report, requested by lawmaker Kang Min-guk, revealed that in just 54 minutes, the hackers moved 104.0647 billion coins to unidentified external wallets. These coins, all part of the Solana ecosystem, represent losses of about 32 million coins, equating to $9,296 per second.
An Upbit spokesperson assured that the platform is taking measures to prevent further customer losses, stating, "After the hack, we focused on preventing further withdrawals and then reported the incident to the authorities immediately after we confirmed we had suffered a security breach." The data indicated that the majority of the financial loss came from Solana (SOL) coins, with a $12.9 million loss in these tokens. However, in terms of volume, 91% of the stolen assets were Bonk, a Solana-based meme coin, alongside smaller quantities of Pudgy Penguin and Official Trump coins.
The FSS is conducting an on-site inspection at Upbit, with some officials in Seoul expressing concerns about the FSS's limited capacity to enforce stringent disciplinary actions. EBN, another South Korean publication, reported that the National Police Agency’s Cyber Terrorism Investigation Unit has launched a formal inquiry following an inspection at Dunamu’s headquarters. While some government entities have speculated about North Korean involvement, citing previous hacks on South Korean exchanges, the police official noted that the investigation is still in its preliminary stages, with no suspects identified yet.