FSS Sanctions Proceedings Target Upbit After $36M Solana Hack Over Disclosure

South Korea’s Financial Supervisory Service (FSS) has opened sanctions proceedings against Dunamu, the operator of Upbit, following the November Upbit Solana hack. After a months-long review, the regulator issued an inspection report, flagging potential breaches of the Virtual Asset User Protection Act—especially duties tied to user protection and unfair trading. FSS scrutiny centers on two points: disclosure timing and Upbit’s crypto security controls. Local reporting says the FSS began its inspection about seven months earlier and issued a formal opinion notice, giving Dunamu a window to respond before penalties are decided. A key complication is that the law reportedly lacks clear penalty clauses for hacks or IT failures, so the case may pass through multiple review stages. Upbit’s reported hack timeline: the Solana hot wallet was hit on Nov. 27, 2025, and withdrawals reportedly ran for about 54 minutes (4:42 a.m. to 5:36 a.m. KST). Total losses were updated to about 44.5 billion won (≈$36 million). Stolen assets reportedly included SOL and a basket of Solana ecosystem tokens. Upbit said Dunamu froze 2.6 billion won of affected assets and covered 38.6 billion won of user losses with company funds. Traders should also note the market backdrop: Upbit faced criticism for how it communicated the hack, and Seoul is considering clearer rules via the Digital Asset Basic Act to address penalties for hacking and IT-failure events. Overall, FSS’s case could shape near-term sentiment around Solana-related exposure on Korean venues and influence longer-term expectations for exchange security and reimbursement standards.