Upbit Identifies Internal Wallet Flaw as Probe Into $30M Breach Expands

• Upbit found and fixed a wallet flaw after detecting $30M in unauthorized withdrawals.
• Weak signature data may have exposed partial private keys during past transactions.
• Authorities and Upbit continue investigations as the exchange rebuilds wallet systems.

South Korea’s largest cryptocurrency exchange is working through a deepening forensic investigation after uncovering a major internal vulnerability while reviewing last week’s $30 million theft. Upbit disclosed that its security team located a defect in its wallet system during a broad audit launched in response to irregular withdrawals detected across Solana-linked assets.

The platform said the weakness, now repaired, may have allowed outside observers to analyze specific past transactions in a way that exposed predictable signature patterns. However, the company has not confirmed whether this issue contributed directly to the unauthorized outflows.

Signature Defect Found After Unusual Withdrawals

According to a statement issued Friday, CEO Oh Kyung-seok said investigators identified a malfunction in Upbit’s internal wallet software that produced weak signature data under certain operational conditions. While private keys are normally concealed in blockchain activity, the flaw created isolated cases where parts of a private key could theoretically be reconstructed through mathematical review of those signatures.

The problem surfaced only after Upbit initiated a full system audit following the detection of suspicious withdrawals on November 27 involving SOL and several Solana-ecosystem tokens, including ORCA, RAY, and JUP. The review covered network configurations, wallet processes, and internal security tools. Shortly after identifying the vulnerability, the platform halted all deposits and withdrawals and began emergency containment procedures.

Exchange Confirms Losses as Services Stay Suspended

Upbit reported confirmed losses of roughly 44.5 billion KRW, or about $30 million, tied to the breach. Customer assets affected within that total stood at approximately 38.6 billion KRW, nearly $26 million. The company said it has already frozen around 2.3 billion KRW (roughly $1.5 million) linked to unauthorized transfers. In response, remaining funds in exposed wallets were transferred to cold storage while portions of the wallet infrastructure were rebuilt.

Oh stated that deposits and withdrawals will resume only after a final inspection of all wallet systems and related internal components. The exchange noted that it will cover all customer losses using its own reserves.

The incident has prompted an expanded internal investigation alongside a government review. South Korean officials are examining the irregular withdrawals and the internal flaw disclosed by the company. Upbit, operated by fintech firm Dunamu, which is preparing for a planned merger with Naver—said the theft did not interfere with those corporate plans.