Lazarus Group Suspected in Upbit Crypto Theft of $30.4M

South Korean authorities suspect North Korea's state-linked Lazarus Group orchestrated a cyberattack on the country's largest cryptocurrency exchange, Upbit, resulting in the theft of approximately 30.4 million in digital assets on November 27, 2025.

The breach targeted Upbit's hot wallets, which hold cryptocurrencies online for quick transactions, leading to unauthorized withdrawals of Solana-based tokens worth 44.5 billion won. Upbit, operated by Dunamu, detected the irregular activity and immediately suspended all deposits and withdrawals to prevent further losses. The company confirmed that cold wallets, which store assets offline, remained secure. Dunamu pledged to reimburse affected users fully from its reserves and has transferred remaining funds to safer storage while cooperating with investigators.

Government officials, citing similarities to a 2019 incident where Lazarus allegedly stole 58 billion won in Ethereum from Upbit, believe the hackers compromised administrator credentials or impersonated staff to authorize the transfers. Blockchain analysis revealed the stolen funds were quickly scattered across more than 185 wallets, swapped for wrapped Solana and USDC...