A billion-dollar acquisition was stolen the day after, is it the work of North Korean hackers again?

Author: Chloe, ChainCatcher

South Korean cryptocurrency exchange Upbit disclosed that it detected abnormal withdrawal behavior around 4 AM today, with approximately 44.5 billion won (about 30.43 million USD) of Solana network assets (including SOL, USDC, and a range of smaller tokens) being transferred to an unspecified external wallet. Upbit stated, "We immediately confirmed the asset outflow caused by the abnormal withdrawal and will cover the entire amount with Upbit's assets to ensure that user assets are not harmed."

Upbit has now frozen approximately 2.3 billion won (about 1.57 million USD) in funds, and other assets are being continuously tracked.

After the incident, the exchange quickly locked down its infrastructure, transferring all assets to secure cold wallets to prevent unauthorized transfers and conducting security reviews on each wallet and signature system.

Coincidentally, exactly six years ago today, Upbit was also hacked. According to Cryptonews, the incident was attributed to North Korean hackers, with stolen ETH valued at around 41.5 million USD. After the theft, Upbit similarly used its own funds to cover the entire amount and suspended trading for two weeks.

Currently, Upbit stated that it is working with multiple projects and relevant institutions to attempt to further freeze or recover the stolen tokens and is preparing to hand over the information to law enforcement. According to South Korean media BlockMedia, the Financial Supervisory Service's Virtual Asset Regulatory Bureau has immediately launched an inspection of the platform. The Financial Supervisory Service stated, "We are aware of this hacking incident and are currently investigating the origins of the hacker attack, the extent of the losses, and the measures taken to protect customer assets."

Additionally, according to Beosin Trace analysis, some of the funds that flowed out abnormally from Upbit have begun to be transferred. Among them, a Binance user address (starting with 2zR) received SOL from multiple intermediary addresses after this incident, totaling approximately 315,000 USD in SOL.

Furthermore, Ki Young Ju, the founder of Crypto Quant, also posted on the X platform stating that after Upbit suspended withdrawals due to the hacking attack, arbitrage bots temporarily halted, allowing retail investors in South Korea to take the opportunity to push up the prices of various altcoins on the platform.

Just Announced a Merger, Now Suspends Deposits and Withdrawals Due to Asset Theft

Upbit's parent company Dunamu just announced a merger with Naver Financial yesterday, with a transaction valuation of approximately 10.3 billion USD, making it one of the largest mergers in South Korean financial history. In addition to promoting the Korean won stablecoin and payment ecosystem, it also aims to pave the way for Upbit's listing in the United States.

According to previous reports, the boards of both parties will merge through an all-stock exchange method. In this share exchange, Dunamu's exchange price per share is set at 439,252 won, while Naver Financial's exchange price per share is set at 172,780 won, with an exchange ratio determined at 1:2.54. Meanwhile, Dunamu's co-founders will hold approximately 30% of the merged entity's shares, becoming the largest shareholders. To avoid triggering South Korean antitrust laws, Dunamu will delegate more than half of the voting rights to Naver, allowing the merger structure to pass smoothly.

Recent financial reports released by Dunamu have solidified its leading position in South Korea's digital asset exchange market, with net income in the third quarter of this year growing by 300% year-on-year to 165 million USD, more than 300% growth compared to the same period last year, making the financial report a strong boost for this merger.

This merger also showcases the high complementarity of both parties' businesses. Naver, as South Korea's top tech giant, has expanded its business landscape from its initial search engine to various fields such as e-commerce (Naver Shopping), payments (Naver Pay), and digital content (Naver Webtoon), forming a complete business ecosystem. With the launch of Dunamu's self-developed L2 GIWA Chain, it is no longer limited to exchange operations but is transitioning to the role of a blockchain infrastructure provider, perfectly complementing Naver's diversified business scenarios. Additionally, this merger lays the foundation for the Korean won stablecoin, which Dunamu is developing and will be issued primarily through Naver Pay, seamlessly connecting the blockchain infrastructure to user-end payments.

However, due to the risks associated with stablecoins, exchange compliance, and market competition issues, this transaction still requires review by South Korea's financial supervisory authorities and the Fair Trade Commission. Furthermore, in early November, Dunamu was fined approximately 25 million USD by the Financial Intelligence Unit (FIU) for KYC violations. At the same time, Upbit suspended new user registrations and deposits and withdrawals for three months.

South Korea's Regulatory Crackdown on Exchanges Poses Challenges for Upbit's Nasdaq IPO

This is one of the largest fines imposed on cryptocurrency exchanges in South Korea in recent years and is part of the government's broad enforcement actions against anti-money laundering and KYC violations in the cryptocurrency industry.

The FIU stated, "During the anti-money laundering review of Dunamu, approximately 5.3 million KYC violations were discovered." The agency also pointed out that Dunamu failed to report 15 suspicious transactions.

According to CoinDesk, Dunamu did not immediately plead guilty to the hefty fine and is even conducting an internal review to appeal. A Dunamu spokesperson also emphasized that the FIU has made errors in judgment in the past. "The FIU previously fined Hanbitco 2 billion won for KYC deficiencies involving about 200 users, but the Seoul court later overturned that fine, ruling that the case did not constitute money laundering."

However, this time, South Korean regulatory agencies have shown no signs of backing down, thoroughly investigating Dunamu, Korbit, GOPAX, Bithumb, and Coinone. According to the FIU report, during the review of their anti-money laundering and other regulatory compliance, it was found that Bithumb, Coinone, Korbit, and GOPAX also violated multiple regulations.

As South Korea's largest cryptocurrency exchange, the penalties faced by Upbit since the beginning of the month and the asset theft incident today coincide with the recent announcement of the merger plan between Dunamu and Naver Financial, particularly during this sensitive period when Upbit is considering seeking a Nasdaq IPO, undoubtedly posing challenges to its expansion plans.