Overview
- Upbit suspended all deposits and withdrawals after flagging abnormal transfers from a Solana hot wallet at 04:42 KST on Nov. 27.
- Dunamu pledged full reimbursement from company reserves and transferred remaining holdings to cold storage pending a security audit.
- The exchange says roughly 12 billion won in LAYER tokens has been frozen on‑chain, with additional freezes pursued with token projects.
- On‑chain analysis indicates the stolen assets were converted to USDC and bridged to Ethereum in early laundering steps.
- Authorities cite similarities to Upbit’s 2019 breach as they investigate a potential Lazarus Group link and review the incident during Naver’s planned takeover of Dunamu.