South Korea watchdog targets Solana wallet breach

TLDR

South Koreas main financial watchdog is moving to sanction Upbit over a major 2025 Solana-based wallet breach, tightening scrutiny on how exchanges safeguard user funds.

1. The Financial Supervisory Service (FSS) has launched formal sanctions proceedings against Upbits parent Dunamu after a hack drained tens of millions of dollars in Solana-based assets.
2. Upbit reimbursed users and overhauled its custody setup, but the case exposes legal gaps and raises pressure on all Korean exchanges handling Solana and other tokens.
3. Regulators are using this incident to push broader digital asset rules, including stronger hacking penalties and clearer treatment of self-custodied crypto wallets.

Deep Dive

1. What Happened In The Solana Wallet Breach

On 27 November 2025, Upbit suffered a hot wallet compromise that specifically hit Solana-based assets held on the exchange. Reports now put the loss at about 44.5 billion won, roughly 32 million dollars, drained over less than an hour from an exchange-controlled wallet rather than from the Solana network itself.

Upbits response included halting deposits and withdrawals, moving remaining funds to cold storage, tracing the stolen assets, and promising to cover customer losses with company reserves, according to a detailed sanctions coverage report.

The FSS has since sent Dunamu an inspection opinion letter and begun a formal sanctions process. Any penalties will pass through multiple review bodies, including a sanctions committee and the Financial Services Commission, before becoming final.

2. Impact On Solana Users And Korean Exchanges

Because Upbit committed to reimbursing affected customers and rebuilt its wallet systems, direct user losses appear limited, but the case is a warning about venue risk for anyone holding Solana or other assets on Korean exchanges.

The investigation focuses on whether Upbit complied with the Virtual Asset User Protection Act, which sets rules for custody and user protection but does not clearly define penalties for hacking or IT failures. That ambiguity makes the final sanctions level uncertain, but the fact that the process is underway signals tougher expectations around hot wallet security and incident disclosure.

For Solana users globally, this is primarily an exchange security story, not a protocol-level exploit. The main impact is on trust and on how aggressively exchanges in South Korea and elsewhere harden their Solana custody setups and limit hot wallet exposure.

3. Regulatory Shift Around Custody And Hacks

The Upbit case is playing out alongside a broader regulatory buildout. Since the Virtual Asset User Protection Act took effect in 2024, authorities have investigated more than 40 unfair trading cases and are preparing second-phase rules, including account freezes and whistleblower rewards, to combat market abuse, as outlined in recent enforcement updates.

Separately, tax officials have proposed explicit Criminal Procedure Act changes to let courts seize self-custodied crypto, with warrant rules for private-key wallets and joint custody arrangements, following a security incident involving seized assets, detailed in a paper on self-custodied asset seizure.

The Upbit Solana breach is therefore a test case for how far regulators can go under current law and a driver for adding clearer hacking and technology failure provisions in upcoming legislation.

Confidence: high because the breach, reimbursement, and sanctions process are documented across multiple regulatory and media reports.

Conclusion

South Koreas move against Upbit over the Solana wallet breach is less about one exchanges mistake and more about a tightening regime around crypto custody and market integrity. The incident did not compromise the Solana chain itself, but it is accelerating demands for stronger hot wallet security, clearer hacking penalties, and rules for both exchange-held and self-custodied assets. For crypto users, the key signal is that regulators are increasingly willing to treat exchange security failures as sanctionable events, which could reshape how platforms manage risk and disclose incidents.