What breached Upbit Solana hot wallet?

TLDR

Upbit has not confirmed a root cause. The exchange reported abnormal withdrawals from a Solana hot wallet and says the technical entry point is still under investigation. Details not yet disclosed in an official post-mortem were noted by reputable reporting. Method not disclosed.

1. The Solana hot wallet was drained across many tokens for about $3638 million; Upbit halted deposits and moved funds to cold storage. Breach summary.
2. Upbit pledged to fully compensate users and has frozen a portion of affected tokens such as LAYER. Compensation and freezes.
3. Early reporting points to a possible internal wallet software flaw and separate suspicion of Lazarus involvement, but both are unconfirmed. Wallet flaw report and Lazarus suspicion.

Deep Dive

1. What Was Breached

Irregular withdrawals were executed from a Solana hot wallet, siphoning 20+ Solana ecosystem tokens worth roughly 54 billion KRW. Upbit immediately suspended Solana-related deposits and withdrawals and shifted assets to cold storage for containment. Incident overview.

• The exact intrusion vector has not been disclosed by the company, and reputable coverage states the entry method remains under investigation. Method not disclosed.

2. Early Clues, Not Confirmed

Media coverage following an emergency audit says Upbit found an internal wallet software flaw that produced weak, predictable signature data, which could theoretically enable key derivation if exploited. This has not been formally confirmed in a public post-mortem. Wallet flaw report.

Separately, Korean outlets and analysts suggest the North Korea-linked Lazarus group could be involved, with some speculation about admin credential hijacking consistent with past attacks. These points remain investigatory, not definitive. Lazarus suspicion and admin credential angle.

3. Containment And User Impact

Upbit states it will fully reimburse customers and has coordinated with token teams to freeze a portion of assets, including LAYER, while the broader investigation proceeds. Compensation and freezes.

• Reporting also notes the lack of disclosed technical details but confirms service suspensions and asset moves to cold storage as immediate controls. Status and controls.

Conclusion

The confirmed facts are a Solana hot-wallet breach, rapid containment, and a reimbursement pledge, while the root cause is still unannounced. Preliminary theories range from an internal wallet-signature weakness to credential compromise with possible Lazarus involvement, but none are proven yet. Expect clarity when Upbit publishes a formal post-mortem; until then, treat cause attributions as provisional.