Upbit Gets Déjà Vu Hacked

Olivia Capozzalo & Denis Omelchenko
November 27, 2025

Happy Thanksgiving, Defiers!

Today’s big story:

South Korea’s largest CEX experienced a nasty case of déjà vu as ~$30M was drained from one of its Solana hot wallets today — exactly 6 years after its last exploit

In other news:

Grayscale registers to convert ZEC trust to ETF
Hyperliquid faces backlash over MON ticker
JPMorgan’s account closures highlight hypocrisy
Magma launches Monad’s flagship liquid staking protocol [SPONSORED]

Read more below! But first, please give our sponsors some love; they make this newsletter possible.

Filecoin Onchain Cloud is live! Verifiable and programmable storage, fast retrievals, and onchain payments so builders can run real workloads without Big Cloud lock-in. Let's open the cloud: Filecoin.Cloud

Stake MON to earn yield and Magma Points. Magma is the leading native LST protocol on Monad. Start staking today: https://www.magmastaking.xyz/

We’re back! Here’s what you need to know in web3 today

📈 Markets in the Past 24 Hours

TICKER	VALUE	24H
Bitcoin	$91,437	2.22 %
Ethereum	$3,016.25	0.03 %
XRP	$2.2	-1.08 %
BNB	$892.59	0.52 %
Solana	$141.61	0.87 %

Today’s Big Story

Upbit’s Déjà Vu Day: Korea’s Largest CEX Hacked for $30M

South Korea’s largest cryptocurrency exchanges, Upbit, experienced a nasty case of déjà vu as the exchange reported an unauthorized outflow from its Solana hot wallet today, Nov. 27 — the very same date the exchange was hacked six years ago.

This time, the breach drained roughly $30.4 million (44.5 billion won) worth of Solana-network tokens from an Upbit hot wallet, according to the exchange’s latest official update. Upbit says its cold wallets weren’t hit, and the firm moved remaining funds into cold storage while pausing deposits and withdrawals.

Oh Kyung-seok, CEO of Upbit parent firm Dunamu, said in the statement that the exchange is also trying to freeze the stolen tokens, and has already blocked about $1.6 million worth of Solayer (LAYER) tokens.

Kyung-seok reassured users that the exchange will compensate the stolen funds with its own assets.

Upbit’s Massive Merger

The timing is messy. Not only was the hack mysteriously on the same date as the one six years ago, but it also came just a day after Korean tech giant Naver officially confirmed it’s acquiring Dunamu, according to a regulatory filing with the Financial Supervisory Service. The deal forms a fintech group reportedly valued at about $13.6 billion.

Earlier this week, Korean news outlets reported that Upbit could also pursue a Nasdaq listing after the merger, though nothing has been officially confirmed so far.

Naver and Dunamu reportedly plan to invest around $6.8 billion in financial infrastructure using AI and blockchain, though details weren’t disclosed. It’s not clear if both companies are still sticking to that plan.

The Thursday hack comes on the exact same date as the 2019 one, Nov. 27, when Upbit lost 342,000 ETH from its hot wallet. ETH was trading around $148 at the time, making the total stolen sum worth around $50.4 million — but worth about $1 billion at current prices.

Investigators later traced much of the stolen funds through a complex laundering chain linked to North Korean hacker groups, but the majority of the ETH was never recovered.

Let’s hope this is the last hack of 2025.

Cheers, and happy Thanksgiving to those celebrating.

Denis, staff reporter at The Defiant

Forwarded this newsletter? Subscribe for daily insights and curated news from The Defiant team, Monday-Saturday. It’s free.

Subscribe to Defiant Daily

🎬WATCH

Tokenize Everything: Robert Leshner’s Vision for On-Chain Finance

In the latest episode of The Defiant Podcast, Cami sits down with Robert Leshner — the mind behind Compound, and now the founder of Superstate — to discuss why DeFi itself shouldn’t change, but assets will, how tokenized T-bills, basis strategies, and even equities are finally getting institutional traction, and what happens when DeFi becomes the infrastructure powering TradFi.

Pluis. what he’d do differently after Compound’s messy transition to decentralized governance.

Top News Since Friday

Grayscale Files to Convert Zcash Trust into Spot ZEC ETF Crypto asset manager Grayscale has filed a registration statement with the U.S. SEC seeking to convert its Grayscale Zcash Trust into a spot ZEC exchange-traded fund.
Why it matters: If approved, this would be the first spot Zcash ETF listed on a U.S. stock exchange.
Hyperliquid Catches Flak for Reassigning MON Ticker The Pixelmon team, which purchased MON on Hyperliquid for $500,000, has been hung out to dry after its front-end ticker was displaced by Monad’s MON token. Why it matters: When viewed via a block explorer, Pixelmon’s MON is still MON, and Monad’s is UMON (Unit MON). However, the front-end has been overridden by Hyperliquid Labs, casting doubt on the exchange’s decentralization claims.
JPMorgan Account Closures Highlight Banks’ Crypto Hypocrisy JPMorgan’s reported closure of Strike CEO Jack Mallers’ personal accounts underscores the tension between banks’ public embrace of crypto and their private enforcement of risk policies, experts say. Why it matters: Past bear markets show similar trends, and analysts warn that without clearer risk frameworks, these debankings will continue.