TLDR
Upbit reported a breach of its Solana hot wallet.
- Loss was about $36$38.5 million, with Solana-related deposits and withdrawals paused pending checks (market update).
- Multiple Solana ecosystem tokens were affected, including SOL, USDC, BONK, RENDER, PYTH, RAY, JUP, ORCA (news report).
- Upbit pledged to fully compensate users and has frozen a portion of stolen assets on-chain (exchange response summary).
Deep Dive
1. Loss and Pause
Upbit disclosed an abnormal outflow tied to a compromised Solana hot wallet, estimating the loss at roughly $36$38.5 million.
- The incident was flagged around early morning on 27 Nov, triggering a halt in Solana-related deposits and withdrawals (market update).
- Initial estimates referenced 54 billion KRW, later refined to reflect asset prices at the breach time (follow-up coverage).
This was an exchange wallet compromise, not a Solana protocol failure. Operational hot wallets carry higher risk than segregated cold storage.
2. Token Scope
The breach touched a wide basket of Solana assets, not just SOL.
- Reported impacted tokens include SOL, USDC, BONK, RENDER, PYTH, RAY, JUP, ORCA, among others (news report).
- Security firms and outlets corroborated that funds moved to external wallets before containment actions began (incident summary).
Exposure across many SPL tokens suggests direct hot-wallet access rather than isolated single-token exploits.
3. Response and Recovery
Upbit moved remaining assets to cold storage, published affected addresses, and began coordinated freezes with projects.
- The exchange pledged full reimbursement from its own reserves and froze portions of LAYER on-chain while audits proceed (exchange response summary).
- Broader system checks continue before restoring normal deposit and withdrawal services (market update).
Operational continuity depends on audit outcomes. User funds are positioned to be protected via exchange reserves, reducing immediate customer impact.
Conclusion
The exchange that reported the SOL wallet breach was Upbit. The event was a hot-wallet compromise affecting multiple SPL tokens, not a Solana network failure. Upbits rapid containment, audits, and compensation pledge aim to limit user fallout while highlighting the persistent operational risks of exchange-managed hot wallets.
