TLDR
Upbit paused Solana (SOL) deposits after detecting abnormal withdrawals from its Solana hot wallet during a security breach.
- The breach involved unauthorized Solana ecosystem withdrawals estimated at about 44.5 billion won, prompting an immediate halt in flows and a forensic review (report).
- Upbit suspended deposits and withdrawals, overhauled its wallet system, and shifted assets toward near total cold storage to contain risk (update).
- Services resumed after the upgrade, and recovery efforts have frozen about $1.77 million linked to the incident (coverage).
Deep Dive
1. What Triggered the Halt
Upbit discovered unusual withdrawal patterns from a Solana hot wallet, confirming unauthorized outflows of Solana ecosystem tokens. This led to an immediate pause in deposits and withdrawals while the exchange initiated incident response and investigation. Tokens cited included SOL, ORCA, RAY, and JUP, and the initial loss estimate on the Solana network was later refined to about 44.5 billion won (report).
The deposit halt was a standard containment step after a wallet compromise, aimed at preventing further inflows or laundering while engineers secured systems.
2. How Upbit Contained Risk
Containment focused on stopping inflows and pushing assets into offline custody. Upbit moved nearly all customer assets to cold storage, reviewed its wallet infrastructure, and targeted a near zero hot wallet ratio. This security pivot exceeded domestic norms and aligned with a tighter custody posture after the Solana incident (update).
Hot wallets are convenient but attackable. Shifting to cold storage reduces online attack surface, although it can trade off some withdrawal speed during stress.
3. Aftermath and Recovery
Upbit resumed deposit and withdrawal services after completing wallet replacement and security enhancements. It also launched on-chain tracking and coordination with other platforms, contributing to roughly $1.77 million in frozen funds tied to the breach. This indicates ongoing asset recovery alongside restored operations (coverage).
For users, the halt was exchange-side risk control, not a Solana network shutdown. The path back to normal included security upgrades and cross-exchange recovery.
Conclusion
Solana deposits at Upbit were halted because of a security incident in a Solana hot wallet. Pausing flows allowed Upbit to contain risk, harden custody by moving toward cold storage, and resume services after upgrades while continuing recovery efforts.
CoinsKid.Com