Sanctions Case Opens Against Upbit Operator Over $36M Hack

South Korea opens a sanctions process against Dunamu

South Korea's Financial Supervisory Service (FSS) has sent Dunamu an inspection opinion letter over a major hack at its Upbit exchange, according to Yonhap News. The letter marks the formal start of a sanctions procedure by the country's financial authorities. It gives Dunamu a chance to respond to the inspection's findings before the regulator sets out any proposed penalties. The move follows months of scrutiny of the country's largest exchange operator.

The November breach drained about $36 million

The breach hit Upbit on 27 November 2025 and drained about $36 million in crypto assets, many of them Solana-based tokens. The attack lasted around 54 minutes and began at 4:42 a.m. Korea Standard Time (KST). Upbit only disclosed the incident at the end of that day, and the announcement followed a Naver Financial event, according to Yonhap News. The delay drew criticism. Yonhap News reported that the exchange later froze roughly 2.3 billion won ($1.5 million) worth of funds linked to the theft. The frozen amount represents only a small share of the total stolen.

Regulators review a possible law violation

The FSS said it is reviewing whether Upbit breached the Virtual Asset User Protection Act, South Korea's main law for crypto consumer protection. That law contains no direct sanctions provisions for cyberattacks or computer system incidents. Yonhap News reported that this gap leaves the scope of any penalty uncertain, even as the formal process moves ahead. The inspection letter is an early step in that process, not a final ruling on the case. How the regulator applies the law could shape future cases against other exchanges.

An earlier fine added to Dunamu's regulatory pressure

The sanctions review is not Dunamu's first clash with regulators. South Korea's Financial Intelligence Unit, part of the Financial Services Commission, earlier imposed a fine of about 35.2 billion won ($24.35 million) on the company in a separate matter, according to reporting on the case. The new inspection letter adds to that pressure. The company operates Upbit, which handles a large share of domestic crypto trading, so any regulatory decision that follows carries high stakes.

Solana trades near $76 at time of publication

Much of the stolen value sat in Solana-based tokens, tying the incident to one of the busiest blockchains for trading. Solana (SOL) traded at $76.00 at the time of publication, up 1.55% over the past 24 hours (CoinPaprika, 19 July 2026). Trading volume in SOL reached about $879 million over the same period (CoinPaprika, 19 July 2026). Its market value stood near $44.3 billion, keeping SOL among the ten largest cryptocurrencies by market value.

What the sanctions process could mean next

For now, the outcome depends on how the FSS reads a law that was not written with hacking penalties in mind. Dunamu can present its position during the response window before the regulator reaches a decision. Any sanction, if imposed, would set an early marker for how South Korea holds exchanges accountable for security failures.