Upbit Restarts Services After $37M Lazarus Group Hack

• South Korea’s largest cryptocurrency exchange to gradually restore deposits and withdrawals starting December 1, 2025.
• $36.8 million worth of Solana-based assets stolen, with suspected involvement of North Korea’s Lazarus Group.

South Korea’s largest cryptocurrency exchange, Upbit, will resume phased deposit and withdrawal services on December 1, 2025, following a major security breach. The reinstatement, scheduled to begin at 1 PM KST, comes after hackers stole approximately $36.8 million in Solana-network assets on November 27, as reported by Cryptopolitan on November 30.

In response to the breach, Upbit swiftly suspended all deposit and withdrawal functionalities to prevent further exploitation. Remaining assets were transferred to cold storage, ensuring additional security. Oh Kyung-seok, Upbit’s CEO, reassured users that the exchange’s reserves would fully cover the stolen funds with no financial impact on customers.

South Korean authorities are investigating suspected ties between the incident and the Lazarus Group, a North Korean state-affiliated cybercrime organization known for targeting cryptocurrency exchanges. Notably, Lazarus was implicated in a 2019 hack affecting Upbit. Investigators speculate that compromised or impersonated administrator accounts were used to execute the theft, with stolen assets converted into USDC stablecoins before being transferred to the Ethereum network in an attempt to mask their origin.

Meanwhile, the Financial Supervisory Service has launched an on-site investigation at Upbit, expected to conclude on December 5. The exchange has confirmed several enhanced security measures, including new deposit addresses required for cryptocurrency transactions. As part of the phased restoration process, priority will be given to assets such as Akash Network’s AKT and other Ethereum-based tokens.

Market activity surrounding affected assets remains notable. As of November 30, 2025, 15:08 UTC, Solana (SOL) trades at $137.92, reflecting a 0.83% increase in trading volume over the past 24 hours. USDC stablecoins (USDC) are priced at $1, with a 0.01% decrease in trading volume. Akash Network (AKT) is valued at $0.505 following a 1.37% gain in 24-hour trading volume, while Ethereum-based Raydium (RAY) trades at $1.10—up by 0.57% in the same period. This data accentuates the continued trading activity of assets impacted by the breach.