FSS sanctions Dunamu over delayed disclosure of $36M Upbit hack
South Korean regulators have initiated a sanctions process against Upbit operator Dunamu over a delayed disclosure of a $36 million hack, exposing a critical gap in the country's emerging digital asset framework.
South Korea’s Financial Supervisory Service has formally opened a sanctions procedure against Dunamu, the operator of crypto exchange Upbit. The regulatory action follows a $36 million exploit in November 2025 and centers on the company’s delayed public disclosure of the breach.
The FSS recently sent an inspection opinion letter to Dunamu, giving the firm a chance to respond before formal penalties are proposed. The regulator's scrutiny focuses on Upbit's decision to withhold news of the cyberattack for most of the day. The 54-minute breach began at 4:42 a.m. local time on November 27, but the exchange did not inform the market until after a merger-related event involving internet giant Naver Financial had concluded.
This case highlights a significant vulnerability in South Korea’s crypto regulatory architecture. The Virtual Asset User Protection Act, the current framework governing the sector, contains no explicit provisions for sanctioning cyberattacks or computer system failures. This legal ambiguity leaves the ultimate scope of penalties against Dunamu uncertain.
To address this gap, South Korean authorities plan to introduce sanctions and compensation provisions specifically targeting hacking incidents. These measures are slated for inclusion in the second phase of the Digital Asset Basic Act.
For Dunamu, the direct financial fallout from the November exploit was contained. The exchange froze approximately 2.3 billion won ($1.5 million) and fully reimbursed affected customers from its own balance sheet. Upbit subsequently overhauled its wallet architecture, migrating all assets from affected wallets, and launched an automated tracking system in December to trace the stolen funds.
Upbit currently ranks as the third-largest crypto spot exchange globally by traffic, liquidity, and trading volumes, according to CoinMarketCap. While its balance sheet proved resilient enough to absorb the immediate losses, the FSS proceedings introduce fresh regulatory risk for a major digital asset platform.
