North Korean group linked to another major attack on South Korea’s top exchange

BTC-USD -0.66% BITF +12.26%

The third quarter of 2025 has hardly been kind to the crypto market.

Bitcoin (BTC), which hit an all-time high (ATH) north of $123,000 in early October, is today struggling to stay afloat at the $90,000 level. No other cryptocurrencies are doing any better.

Related: Chapter 11 bankrupt crypto firm scores millions in arbitration win

The industry has seen shops shutting down or going bankrupt.

First, the prominent dApp analytics platform DappRadar shut down as running it turned out to be "financially unsustainable" during the "current environment."

Next, a collapsed Brazilian crypto company called Rental Coins filed for Chapter 15 bankruptcy in the U.S. to help it recover assets.

Then, the popular energy and digital infrastructure company Bitfarms Ltd. (Nasdaq/TSX: BITF) announced it is completely abandoning Bitcoin mining operations for AI by 2027.

Now, another piece of shocking news has emerged: a leading crypto trading exchange has lost millions of dollars in a hack.

More News:

• Popular crypto company shuts down as Bitcoin crashes

• Bankrupt crypto exchange moves millions in Bitcoin after months

• Popular North American company shuts down Bitcoin mining operations for AI

South Korea's largest crypto exchange loses millions

Launched in 2017, Upbit is the largest crypto trading exchange in South Korea.

On Nov. 27, it reported a loss of approximately $36.8 million in a breach.

The crypto exchange said it encountered irregular withdrawals of Solana network assets linked to a compromised wallet address.

The exploit affected several cryptocurrencies, including:

• Solana (SOL)

• Bonk (BONK)

• Official Trump (TRUMP)

• Pudgy Penguin (PENGU)

• Moodeng (MOODENG)

• USD Coin (USDC)

The incident forced the platform to halt some services. It has launched an emergency security review of all related networks and wallet systems.

Upbit CEO Oh Kyung-seok said the crypto exchange will fully compensate the entire amount with its own assets so that members’ assets don't get affected due to the exploit.

The crypto exchange has moved all remaining funds into cold storage to prevent any suspicious withdrawals and is working with project teams to freeze assets on-chain after already blocking part of the Solayer (LAYER) funds. It added that deposits and withdrawals will only restart once full security checks are finished.

Notably, South Korea's popular fintech firm Naver Financial announced on Nov. 26 that it will acquire Upbit’s parent company, Dunamu, in an all-stock deal valued at $10.29 billion.

North Korea-linked Lazarus Group suspected behind Upbit hack

On Nov. 28, a local media news agency reported that Lazarus, the hacking group frequently linked to the North Korean state, is suspected to be behind the latest attack on Upbit.

This isn't the first time that Upbit has suffered an exploit.

Exactly six years ago, the crypto exchange lost $48.5 million in Ethereum (ETH) in an exploit on Nov. 27, 2019. Even then, the Lazarus Group was suspected to be behind the exploit.

Related: Crypto's biggest sleuth has 10 shocking questions on hacks

This story was originally published by TheStreet on Nov 27, 2025, where it first appeared in the MARKETS section. Add TheStreet as a Preferred Source by clicking here.