South Korea regulator starts exchange hack sanctions

TLDR

South Koreas main financial regulator has started a formal sanctions process against Upbits parent Dunamu over a major 2025 exchange hack and delayed disclosure.

1. The Financial Supervisory Service sent an inspection opinion letter on the $36 million Upbit hack, formally opening a sanctions case against Dunamu.
2. Regulators are testing the Virtual Asset User Protection Act, which lacks clear penalties for hacks, and plan to add explicit sanctions and compensation rules in new digital asset laws.
3. The outcome will set a precedent for Korean exchanges on breach disclosure, technical security, and future enforcement, important for anyone using won-based crypto venues.

Deep Dive

1. What The Regulator Has Done

Reports from Korean media and international outlets say the Financial Supervisory Service (FSS) has sent Dunamu an inspection opinion letter over the Upbit hack that hit Solana based wallets in November 2025, with losses estimated around $36 million to about 44.5 billion won (roughly $32 million) by later counts. This letter formally begins a sanctions procedure and gives Dunamu a chance to respond before proposed penalties are decided, as detailed in coverage of the FSS action against Dunamus role in the hack and delayed disclosure on platforms like Cointelegraph and crypto.news.

Upbit was criticized for announcing the breach only after a same day merger related event with Naver Financial, even though the exploit lasted about 54 minutes that morning, which is now one of the points under review.

2. Legal Gaps And Planned Reforms

The case sits under South Koreas Virtual Asset User Protection Act, a law focused on custody, unfair trading, and user safeguards. Current reports stress that the Act does not yet contain direct sanctions provisions for cyberattacks or system failures, which makes the severity and type of penalties uncertain for this hack.

Authorities are using this episode to justify tightening rules, with plans to add specific sanctions and compensation obligations for hacking and system failures in the second phase of the Digital Asset Basic Act, according to the same regulatory commentary about closing legal gaps around exchange hacks.

3. Exchange Risk And What To Watch

Upbit has tried to show remediation by freezing part of the funds, pledging to fully reimburse users from its own assets, overhauling its wallet architecture, and launching an automated onchain tracing system called Onchain AI Tracer to track stolen funds. At the same time, South Korean agencies report dozens of completed investigations into unfair trading under the new user protection regime, signaling a broader shift toward active market policing.

Key next signals will be:

1. The level and type of sanctions FSS ultimately proposes for Dunamu.
2. Whether lawmakers pass the Digital Asset Basic Act changes that hard code hack penalties and user compensation rules.
3. How other Korean exchanges adjust disclosure speed, wallet design, and monitoring to avoid similar regulatory action.

Conclusion

South Korea is turning a high profile Upbit hack from late 2025 into a test case for exchange accountability and modern digital asset regulation. The sanctions process against Dunamu, combined with planned legal upgrades that explicitly address hacks and system failures, is likely to raise the bar for security, transparency, and user protection across Korean venues, with ripple effects on how global exchanges handle major breaches.