Upbit parent Dunamu faces South Korean regulator sanctions process: Report

South Korea’s Financial Supervisory Service (FSS) has initiated a sanctions process against Dunamu, the operator of the Upbit cryptocurrency exchange, in connection to a $36 million hack that occurred in November 2025. The FSS sent Dunamu an inspection opinion letter, marking the formal start of the sanctions procedure. This letter allows Dunamu to respond to the inspection findings before the regulator makes a formal decision on proposed sanctions. Cointelegraph reached out to Dunamu for comment, but no response was reported in the source.

The hack took place on November 27, 2025, lasting approximately 54 minutes beginning at 4:42 a.m. KST. Upbit faced criticism for delaying the announcement of the breach until the end of the day, after a merger event involving internet giant Naver Financial had concluded. The South Korean financial regulator is investigating whether Upbit violated the Virtual Asset User Protection Act; however, this act currently lacks direct provisions for sanctions related to cyberattacks or hacking incidents.

In response to the exploit, Upbit froze about 2.3 billion won (approximately $1.5 million) in funds and committed to reimbursing all affected customers fully using its own balance sheet. The exchange also undertook significant security improvements, including overhauling its crypto wallet architecture and migrating assets from vulnerable wallets. Additionally, Upbit developed an automatic onchain tracking service called the Onchain AI Tracer System in December 2025 to trace the stolen funds and support recovery efforts.

South Korean authorities are considering regulatory updates to close existing gaps, aiming to introduce sanctions and compensation measures concerning hacking and computer system failures in the planned second phase of the Digital Asset Basic Act. Upbit remains one of the top crypto spot exchanges globally, ranking third on CoinMarketCap based on factors like traffic, liquidity, and trading volumes. The sanctions process reflects increasing scrutiny on exchanges to enhance security and transparency within South Korea’s crypto sector.