South Korea's financial watchdog has moved Dunamu into a formal sanctions process over Upbit's November hack, and the hard question now is whether Seoul has the legal tools to punish a crypto exchange for being breached.
The Financial Supervisory Service has sent Dunamu an inspection report over the 44.5 billion won theft from Upbit, according to SBS reporting cited by The Block on July 19. That starts the sanctions track. This is the live case now. What happens next will tell you whether a Korean exchange pays only for the coins it loses, or also for the control failures regulators believe sat behind the loss.
The hack began at 4:42 a.m. local time on November 27, 2025. Attackers drained Solana-network assets from an Upbit hot wallet to an outside address over about 54 minutes, SBS reported. Yonhap put the confirmed loss at 44.5 billion won, or about $30.1 million, after Dunamu revised an earlier 54 billion won estimate. The tokens included Solana-linked assets such as SOL, USDC, BONK, JUP, RAY, ORCA, RENDER, PYTH and TRUMP.
Here's the detail you can't ignore. The breach landed six years to the day after Upbit's last major hack, the November 27, 2019 theft of about 340,000 ETH then worth 58 billion won. South Korean investigators later blamed North Korean hackers for that attack. Same date. Same exchange. That is not poetry. It is the kind of coincidence that makes regulators look twice at everything from hot-wallet controls to internal disclosure calls.
The hack is only one part of the case
Government and industry sources told Yonhap after the November breach that authorities suspected the Lazarus Group, the North Korean state-linked hacking operation, may have been behind the theft. That remains a serious allegation, not a finished public finding. The safer fact is narrower: financial authorities opened an inspection after the incident, and SBS now reports that the FSS has moved from inspection to sanctions procedure.
Upbit says it covered users. CoinDesk reported that Dunamu reimbursed 38.6 billion won in affected customer assets from company reserves, while 2.3 billion won had been frozen through blockchain tracking in the first days after the breach. SBS later put the frozen amount at 2.6 billion won and said recovery procedures were still underway. That distinction matters. Making customers whole limits the consumer damage, but it doesn't answer whether the exchange's systems were good enough in the first place.
The legal problem is more awkward. SBS reported that the Virtual Asset User Protection Act does not contain direct sanction provisions for hacking or IT system failures, even though the FSS has been reviewing whether Dunamu violated the law. Regulators can investigate. They can pressure. The heavy disciplinary route is less clean because the statute was written mainly around user protection and unfair trading, not a hot-wallet drain attributed to an outside attacker.
Dunamu already had regulatory smoke
This isn't Dunamu's only fight with Korean authorities. Yonhap reported in November that the Financial Intelligence Unit fined Dunamu 35.2 billion won over customer identification failures, including about 5.3 million customer due diligence violations and 15 missed suspicious transaction reports. Earlier, in February 2025, the FIU imposed a three-month partial business suspension that barred new customers from transferring crypto assets to others from March 7 to June 6.
That timing matters. When a company is already under sanction for anti-money laundering failures, a later hack does not arrive as an isolated mishap. It becomes part of a larger story about controls. Frankly, that is why Dunamu should expect a colder hearing than an exchange with a cleaner year behind it.
Disclosure also sits in the file. SBS reported that Upbit announced the hack only after a merger-related event with Naver Financial had concluded on the same day. If you run an exchange holding other people's money, the first useful disclosure is not the one that fits neatly around a corporate event. It is the one that lets customers know their assets have just been attacked.
The final decision still has several rooms to pass through: a Sanctions Review Committee, the Securities and Futures Commission, and then the Financial Services Commission. No ruling has been announced. No date has been set. But the direction of travel is clear enough. Seoul is trying to decide whether a crypto custody failure can be punished even when the current law does not say so plainly.
If Dunamu gets only a modest penalty, other exchanges will read the case as a reimbursement problem. Pay users back, absorb the reputational hit, move on. If the FSC pushes harder, with tighter conditions, audits or business limits, you will see a different message: in South Korea, a hacked exchange can be treated as a compliance failure even when customers are reimbursed.
Also read: Arthur Hayes Sells Ethereum At A Loss Then Buys It Back Higher • Lorenzo Protocol's BANK Token Rockets 517% After a Mysterious Wallet Move • Amazon Japan's Logistics Partner Will Pay 2300 Drivers in Stablecoin
