The day after a $10 billion acquisition was stolen, was it the work of North Korean hackers?

null

Author: Chloe, ChainCatcher

Korean cryptocurrency exchange Upbit disclosed that it detected abnormal withdrawal activity at around 4 AM today, with approximately 44.5 billion won (about 30.43 million USD) worth of Solana network assets (including SOL, USDC, and a series of smaller tokens) being transferred to an unspecified external wallet. Upbit stated, “We immediately confirmed the asset outflow caused by the abnormal withdrawal and will cover the entire amount with Upbit's assets to ensure that user assets are not harmed.”

Upbit has now frozen approximately 2.3 billion KRW (about 1.57 million USD) in funds, and other assets are being continuously tracked.

The exchange quickly locked down its infrastructure after the incident, transferring all assets to secure cold wallets to prevent unauthorized transfers, and conducted a security audit on each wallet and signature system.

Coincidentally, on this day six years ago, Upbit was also hacked. According to Cryptonews, the incident was attributed to North Korean hackers, and the stolen ETH was worth approximately $41.5 million. After the theft, Upbit also used its own funds to cover the entire amount and suspended trading for two weeks.

Currently, Upbit indicates that it is collaborating with multiple projects and related agencies to attempt to further freeze or recover stolen tokens, and is preparing to hand over the information to law enforcement agencies. According to Korean media BlockMedia, the Financial Supervisory Service's Virtual Asset Regulatory Bureau has immediately launched an inspection of the platform. Financial Supervisory Service: “We are aware of this hacking incident and are currently investigating the origins of the hacker attack, the extent of the losses, and the measures taken to protect customer assets.”

In addition, according to Beosin Trace analysis, some funds that flowed out abnormally from Upbit have begun to be transferred. Among them, Binance user addresses (starting with 2zR) have received SOL that flowed out abnormally from Upbit from multiple intermediary addresses after this incident, with a total value of approximately $315,000 in SOL received so far.

The founder of Crypto Quant, Ki Young Ju, also posted on X platform stating that after Upbit suspended withdrawals due to a hacking attack, arbitrage bots temporarily halted, allowing retail investors in South Korea to take the opportunity to drive up the prices of various altcoins on the platform.

Just after announcing the acquisition, the withdrawal and deposit were suspended due to asset theft.

Yesterday, Upbit's parent company Dunamu announced its merger with Naver Financial, with a transaction valuation of approximately $10.3 billion, making it one of the largest merger cases in Korean financial history. In addition to promoting the stability of the Korean won stablecoin and payment ecosystem, it also aims to pave the way for Upbit's listing in the United States.

According to previous reports, both boards of directors will merge through a full stock exchange. In this share exchange, the exchange price for Dunamu is 439,252 KRW per share, and the exchange price for Naver Financial is 172,780 KRW per share, with an exchange ratio set at 1:2.54. At the same time, Dunamu's co-founders will hold approximately 30% of the equity after the merger, becoming the largest shareholders. In order to avoid violating South Korean antitrust laws, Dunamu will delegate more than half of the voting rights to Naver, allowing the merger structure to pass smoothly.

Recently, Dunamu's financial report has solidified its leading position in the South Korean digital asset exchange market, with a net income growth of 300% year-on-year in the third quarter, reaching 165 million USD, which is more than a 300% increase compared to the same period last year. This financial performance has provided a strong boost for the recent acquisition.

This merger further demonstrates the high degree of complementarity between the two parties' businesses. Naver, as South Korea's leading technology giant, has expanded its business landscape from an initial focus on search engines to multiple fields including e-commerce (Naver Shopping), payment (Naver Pay), and digital content (Naver Webtoon), forming a complete commercial ecosystem. With the launch of Dunamu's self-developed L2 GIWA Chain, it is no longer limited to exchange operations, but has shifted towards the role of a blockchain infrastructure provider, which complements Naver's diversified business scenarios. Furthermore, this merger also lays the foundation for a Korean won stablecoin, which is being developed by Dunamu and will use Naver Pay as the core issuance channel, effectively opening up the full chain from blockchain infrastructure to user payments.

However, due to concerns regarding stablecoin risks, exchange compliance, and market competition issues, this transaction still requires review by the South Korean Financial Supervisory Service and the Fair Trade Commission. Additionally, at the beginning of November, Dunamu was fined approximately $25 million by the South Korean Financial Intelligence Unit (FIU) for KYC violations. They also suspended new user registrations and deposits/withdrawals on Upbit for a period of three months.

South Korea's regulators are cracking down on exchanges, posing a challenge for Upbit's NASDAQ IPO.

This is one of the heaviest fines imposed by South Korea on cryptocurrency exchanges in recent years and is part of a broad enforcement action by the South Korean government against anti-money laundering and KYC violations in the cryptocurrency industry.

The FIU stated, “During the anti-money laundering review of Dunamu, approximately 5.3 million KYC violations were found.” The agency also pointed out that Dunamu failed to report 15 suspicious transactions.

According to a report by CoinDesk, Dunamu did not immediately plead guilty to the hefty fine and is even conducting an internal review to appeal. A spokesperson for Dunamu also emphasized that the FIU has previously made erroneous judgments. “The FIU imposed a fine of 2 billion won on Hanbitco for KYC deficiencies involving approximately 200 users, but the Seoul court subsequently revoked the fine, ruling that the case did not constitute money laundering.”

However, this time the South Korean regulatory authorities did not back down, conducting a thorough round of searches on Dunamu, Korbit, GOPAX, Bithumb, and Coinone. According to the FIU report, during the review of their anti-money laundering and other regulatory compliance, it was found that Bithumb, Coinone, Korbit, and GOPAX also violated multiple regulations.

As the largest cryptocurrency exchange in South Korea, the penalties faced by Upbit since the beginning of the month and the asset theft incident that occurred today coincide with the announcement of the merger plan between Dunamu and Naver Financial yesterday. This is particularly challenging for Upbit's expansion plans during this sensitive period as it considers seeking a Nasdaq IPO after the merger.