Media: Lazarus Group Carried Out the Attack on the Upbit Exchange

• According to press reports, Lazarus Group may be behind the Upbit hot wallet hack.
• Authorities in South Korea allegedly found signs that the current attack is similar to the 2019 incident.
• Back then, 342,000 ETH was withdrawn from the exchange.

On November 27, 2025, the Upbit exchange reported a hot wallet hack. South Korean authorities believe that the hacker group Lazarus Group, linked to the DPRK, is behind the attack, the Yonhap publication reported.

According to the exchange’s statement, only the hot wallet was compromised. Various crypto assets, meme coins and USDC were withdrawn from it. Some of the funds managed to be traced and frozen.

The company initially claimed a 54 billion won ($36.8 million) loss, but later adjusted the figure to 44.5 billion won ($30.4 million). Details of the hack at the organization were not disclosed.

Citing its sources in government circles, the Yohnap publication reported that the methodology of the attack was the same as in 2019. Back then, 342,000 ETH was withdrawn from Upbit. Suspicion then also fell on Lazarus Group, as the police explicitly stated.

In connection with the incident, the Financial Supervisory Service (FSS) and the Korea Internet and Security Agency (KISA) are conducting inspections at the company. Upbit itself has not commented on this at the time of writing.