South Korea’s largest crypto exchange, Upbit, is under fresh scrutiny. After new details emerged about last month’s major hacking incident. According to data submitted to lawmakers, the attack lasted just 54 minutes. Yet hackers moved out over 104 billion tokens, worth roughly 44.5 billion won.
The breach began at 4:42 a.m. and ended at 5:36 a.m. During that short window, funds linked mainly to Solana based assets flowed into unknown external wallets. By volume, BONK tokens made up more than 99% of the stolen units. By value, however, Solana took the biggest hit at nearly 19 billion won. Other affected assets included Fuzzy Penguin and Official Trump tokens. The pace of the attack shocked many observers. On average, hackers drained about 32 million tokens per second.
Reporting Delay Sparks Public Backlash
The real controversy came after the hack was detected. Investigators confirmed that Upbit became aware of the breach at around 5 a.m. The company moved fast on operations. It held an emergency internal meeting within 18 minutes. Just 27 minutes later, it halted deposits and withdrawals for Solana related assets. By 8:55 a.m., it froze all crypto deposits and withdrawals across the platform.
吴说获悉，据《朝鲜日报》报道，Upbit 在黑客事故发生后超过 6 小时才向金融监管机构报告。Upbit 或因母公司 Dunamu 正与科技巨头 Naver 推进并购事宜，为避免消息冲击而推迟披露黑客事件。韩国金融监督院（FSS）报告称，Upbit 在首次检测到黑客攻击 18 分钟后（凌晨 5 点）召开紧急会议，27…
— 吴说区块链 (@wublockchain12) December 8, 2025
However, despite these quick internal actions, Upbit did not notify regulators until 10:58 a.m. That created a delay of more than six hours from the time the attack began. Reports fromThe Chosun Ilbosuggest that the delay may be connected to ongoing merger talks. Between Upbit’s parent company, Dunamu and tech giant Naver. The claim is that early disclosure could have disrupted sensitive negotiations. While no official confirmation links the two directly, the timing raised serious questions.
Regulators Face a Legal Wall
South Korea’s Financial Supervisory Service (FSS) has launched an on-site inspection at Upbit. Yet legal experts say harsh punishment may be difficult. Current laws do not clearly allow direct sanctions or forced compensation for crypto exchange hacks.
This gap leaves regulators with limited enforcement tools. Even when reporting is delayed, exchanges often escape strong penalties unless negligence is clearly proven under existing financial crime laws. That reality has frustrated many investors and lawmakers. Some are now calling for urgent reforms to tighten reporting rules and impose strict timelines. They argue that crypto platforms should face the same disclosure duties as traditional financial firms.
Upbit Responds as Trust Takes a Hit
Upbit says it fully covered all user losses from the incident. A company official stated that the exchange focused first on stopping further damage. Once the abnormal transfers were confirmed as a breach, it reported the case to the authorities. Still, trust damage may linger. Traders now worry less about the hack itself and more about communication transparency. In fast-moving crypto markets, even a few hours of silence can shape price action and public confidence.
For South Korea’s crypto industry, this case is becoming a stress test for regulation, disclosure rules and corporate accountability. The investigation continues. Meanwhile, investors are watching closely to see whether this case finally pushes lawmakers to close the legal gaps. Currently, this story is no longer just about stolen tokens. It is about what happens when speed, secrecy, and regulation collide.
