TLDR
Upbit halted Solana withdrawals because its Solana hot wallet showed abnormal outflows in a security breach, triggering a pause to protect user assets, audits, and asset freezes on-chain (see the hot?wallet breach report).
- Roughly ?54 billion (~$3638.5 million) was drained across multiple Solana?based tokens, per a detailed incident summary.
- Investigators are examining possible ties to North Korea?linked Lazarus Group, according to a regulatory update.
- Upbit pledged to fully reimburse users and moved remaining assets to cold storage, as noted in a response notice.
Deep Dive
1. What Happened
Upbit detected irregular Solana?network withdrawals and immediately suspended deposits and withdrawals while moving assets to cold wallets and beginning a systemwide audit. Reports estimate about ?54 billion (~$3638.5 million) was drained from a Solana hot wallet, affecting a wide set of ecosystem tokens such as SOL, USDC, BONK, JUP, RAY, PYTH, and ORCA, among others, with some assets (for example LAYER) frozen on-chain to mitigate losses (incident recap, timeline and token list).
The suspension was a containment step. Expect phased resumption only after audits and wallet infrastructure checks are completed.
2. Attribution And Investigation
Authorities are probing whether the exploit involved compromised wallet infrastructure or administrator credentials, and they are assessing overlap with techniques used by Lazarus Group in prior incidents. South Korean investigators said the tactics resemble Lazarus operations and are eyeing attribution, though formal confirmation remains ongoing (investigation status).
Attribution may take time; the key operational response (freezes, audits, reimbursement) is proceeding regardless of ultimate attribution.
3. User Impact And Next Steps
Upbit stated users will be fully reimbursed from corporate reserves, and services will resume progressively after audits. As part of recovery, existing deposit addresses were deleted and must be regenerated before new deposits are made (target restart communicated for Dec 1, 1:00 pm KST) (reimbursement and restart plan).
When services resume, users should generate new deposit addresses and expect staged restoration across networks and assets.
Conclusion
Upbit paused Solana withdrawals to contain a hot?wallet breach on the Solana network, conduct audits, and coordinate asset freezes. Investigators are reviewing possible Lazarus links while Upbit commits to full reimbursement and phased service restoration with new deposit addresses.
Confidence: high because multiple independent reports document the breach, the suspension, and the user?protection steps.
CoinsKid.Com