South Korea’s Financial Supervisory Service has initiated formal sanctions proceedings against Dunamu, the parent entity of Upbit, over the $36 million hack reported in November 2025.
Regulatory authorities have since been examining the incident. However, the country’s current laws do not have provisions for hacking penalties. This has left the authorities unsure about the severity of sanctions they can impose on the cryptocurrency exchange.
South Korean Authorities Begin Sanctions Proceedings Against Dunamu
The Financial Supervisory Service’s action against Dunamu comes after an extensive investigation into Upbit and whether it complied with South Korea’s Virtual Asset User Protection Act. According to media reports, the Financial Supervisory Service has sent Dunamu an investigation opinion letter. The opinion letter lets Dunamu respond to the authorities before they decide on the quantum of penalties, if any, to be imposed. The letter is also the beginning of formal sanctions proceedings against the company.
Upbit Response To Hack Under Scrutiny
Upbit, South Korea’s largest cryptocurrency exchange by trading volume, suffered a major exploit in November 2025, with hackers stealing over $36 million in Solana-based assets. The exploit started at 4:42 AM local time and lasted 54 minutes as hackers drained funds into an external wallet. Dunamu, Upbit’s parent entity, responded to the hack by reimbursing affected users from the exchange’s reserve. It also froze around $1.7 million and continued efforts to recover the frozen funds.
However, the exchange was criticized for disclosing the exploit only after a merger event with Naver Financial was completed.
Dunamu has been under scrutiny from South Korea’s Financial Intelligence Unit, and was recently fined 35.2 billion won after failing to comply with customer verification and anti-money laundering rules. However, a local court cancelled a partial suspension against the company, citing an inadequate legal basis for the sanction.
A Regulatory Gap
The Financial Supervisory Service is examining whether the exploit violated the Virtual Asset Protection Act, which focuses on user protections and unfair trading practices. However, it does not contain direct provisions to sanction cryptocurrency exchanges in the event of a hack, leaving authorities uncertain about the scope of sanctions that can be imposed. South Korean regulators will address the regulatory gap in the Digital Asset Basic Act, which will contain provisions for sanctioning and compensation in the event of a hack or similar incidents.
Lee Chan-jin, Financial Supervisory Service Governor, conceded in a December press conference that sanctions under the existing Virtual Asset User Protection Act have limitations, but added that regulators could not ignore the hack and its impact on users. The Financial Supervisory Service will notify Dunamu of the proposed sanctions after completing a clarification process. Final sanctions on Dunamu will be finalized after discussions between the Sanctions Review Committee, the Securities and Futures Commission, and the Financial Services Commission.
The Financial Supervisory Service recently concluded a separate inspection of Bithumb over misallocated BTC and will begin sanctions proceedings once legal reviews are concluded.
Naver Deal Remains Under Scrutiny
Dunamu’s planned share swap deal with Naver Financial remains under review. Both companies delayed the transaction to December 31 because of several pending regulatory approvals. While developments do not block the deal with Naver Financial, Dunamu faces considerable regulatory scrutiny. The company can also challenge any findings before a final decision is taken.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
