South Korea’s Financial Supervisory Service (FSS) has formally launched a sanctions process against Dunamu, the operator of the major cryptocurrency exchange Upbit, following a wallet breach that resulted in the theft of approximately $32 million (44.5 billion won) in Solana-based assets. The FSS sent Dunamu an inspection opinion letter on July 19, 2026, the first step in a procedure that could lead to penalties or corrective orders.
The hack occurred on November 27, 2025, at 4:42 a.m. local time and lasted about 54 minutes. Upbit disclosed the incident only later that day, after a corporate event involving Naver Financial had concluded, drawing criticism for the delay. The exchange subsequently moved assets to cold wallets, froze roughly $1.5 million, and reimbursed affected users from its own funds. It also overhauled its wallet architecture and introduced an automatic onchain tracking tool, the Onchain AI Tracer System.
A critical challenge for regulators is that South Korea’s Virtual Asset User Protection Act lacks direct sanctions for hacking or computer system failures. This legal gap leaves the extent of possible penalties unclear. The FSS will review Dunamu’s response before issuing any advance notice of a proposed sanction, which must then pass through the sanctions review committee, the Securities and Futures Commission, and the Financial Services Commission. Authorities plan to close the loophole in the next phase of the Digital Asset Basic Act by adding compensation and penalty provisions for cyber incidents.
The case marks a shift toward treating cybersecurity failures as regulatory events, not just technical problems. For Upbit—one of the world’s largest spot trading platforms by volume—the scrutiny carries broad market weight. The sanctions process does not guarantee a final penalty, but it places the exchange’s security practices under formal review as South Korea tightens its crypto rulebook.
