Upbit's 2019 hot-wallet hack lost $48.5M in ETH — the exchange ate the whole loss

On November 27, 2019, 342,000 ETH — about $48.5 million at the then price — moved from Upbit's Ethereum hot wallet to an unknown address in a series of abnormal transactions. South Korea's largest exchange suspended all deposits and withdrawals the same afternoon and swept everything left in hot storage onto offline hardware wallets.

Dunamu, Upbit's parent company, publicly committed to covering the stolen funds entirely from Upbit's own assets. The promise held: customers lost nothing beyond a roughly two-week freeze, and the two-year-old exchange absorbed what was then one of the largest exchange hacks in crypto.

The theft went unsolved for five years. In November 2024 Korea's National Police Agency concluded that North Korea's Lazarus and Andariel units carried out the attack — the first officially confirmed North Korean hack of a domestic crypto exchange — tracing more than half the haul, swapped into bitcoin on three exchanges and scattered across 51 venues in 13 countries.

$48.5M in ETH stolen — ₩58 billion at the time, about ₩1.47 trillion by 2024; two weeks of frozen deposits and withdrawals; only 4.8 BTC ever recovered

Customer deposits sat in an internet-connected hot wallet — one compromised key away from gone, whatever certifications the platform holds.

User protection here was a capital-structure decision: Dunamu could pay from corporate funds, a choice thin-equity exchanges don't have.

The two-week freeze was the price of commingling customer assets with operational float instead of segregated cold storage.

Stolen crypto is effectively unrecoverable once laundered — five years of police work recovered 4.8 BTC out of 342,000 ETH.

A strong balance sheet is an exchange's only real insurance. Upbit could refund users because its parent was rich; thinly capitalized exchanges hit the same way must freeze withdrawals or fail.

Withdrawals resumed after about two weeks, with the remaining hot-wallet float moved to offline storage. In September 2021 Korea's Financial Intelligence Unit accepted Upbit as the country's first newly licensed virtual asset business under the revised financial reporting act, whose new rules included a mandatory ISMS security certification. Police closed the case in November 2024, blaming Lazarus and Andariel: over half the loot was laundered across 51 venues in 13 countries, and only 4.8 BTC (about ₩600 million) was recovered from a Swiss exchange and returned.