South Korea’s largest digital asset exchange, Upbit, temporarily suspended deposits and withdrawals on Thursday after detecting unusual activity in Solana network tokens. The exchange later confirmed that a hot wallet had been compromised, resulting in unauthorized withdrawals of roughly 54 billion Korean won (around $36–$37 million). This marks Upbit’s second major hot wallet hack in six years.

According to Yonhap, South Korean authorities are investigating the breach and considering the North Korea-linked Lazarus Group as a possible culprit. Officials suspect the attack may have involved hijacked or impersonated admin credentials, echoing tactics used by Lazarus during Upbit’s 2019 breach. Analysts noted that North Korea, facing foreign currency shortages, has a history of orchestrating such thefts, often laundering funds through mixing services—a method consistent with Lazarus operations.

The hack occurred on November 27, coinciding with a major corporate merger involving Upbit’s parent company, Dunamu, and Korean tech giant Naver. Security experts suggested the timing may have been deliberate. “Hackers tend to have a strong desire to show off,” one expert told Yonhap. “It is possible they chose the 27th to maximize attention by aligning with the merger announcement.”