Upbit Hot-Wallet Breach on Solana — ≈$36M Stolen; Exchange to Cover Losses
South Korea’s largest exchange Upbit detected an abnormal withdrawal from a Solana-network hot wallet on 27 November 2025, losing roughly ₩54 billion (≈ $36–37 million). Deposits and withdrawals for Solana assets were immediately suspended while engineers moved remaining hot-wallet holdings to cold storage. On-chain investigators and security firms tracked transfers of SOL, USDC and a broad basket of Solana-ecosystem tokens (reported tickers include ACS, BONK, RAY, JUP, PYTH, ORCA, JTO, LAYER, RENDER, MOODENG, TRUMP and others). Approximately ₩12 billion (~$8–9M) in LAYER tokens were frozen after coordination with issuers. Upbit’s parent, Dunamu, said the exchange will cover the full loss from internal reserves so customer balances will not be affected. External forensics and a wider security review of deposit/withdrawal systems are underway and services will be restored gradually after checks. For traders: expect temporary liquidity tightness and higher spreads for the affected Solana tokens while withdrawals are restricted and frozen supply is being negotiated; systemic risk to SOL appears limited for now but token-specific sell pressure and delist/withdrawal restrictions could create volatile moves.
Bearish
Short-term: Bearish for affected Solana tokens. The hot-wallet breach and suspension of Solana deposits/withdrawals reduces available liquidity and increases selling pressure or uncertainty for the specific tokens stolen or frozen, likely widening spreads and prompting price declines for smaller ecosystem tokens. Traders may see rapid volatility as markets repriced risk and some counterparties limit exposure. SOL itself faces limited systemic risk in the immediate term because the incident involved a hot wallet and ecosystem tokens rather than a protocol exploit, but short-term downward pressure is possible if confidence weakens or liquidity providers pull back. Long-term: Neutral to marginally negative if Upbit’s pledge to cover losses and prompt freezing of assets reinstates confidence; systemic impact should be limited provided the exchange completes audits and restores services. Repeated hot-wallet incidents weaken sentiment toward centralized exchange custody and could sustain higher risk premia for Solana ecosystem tokens until security practices are demonstrably improved.