South Korean Regulator Starts Sanctions Review of Dunamu Over Cyber Case

South Korea’s Financial Supervisory Service (FSS) has reportedly begun a formal sanctions process related to the November 2025 $36 million exploit on Upbit, the country’s major crypto exchange operated by Dunamu. According to Yonhap News, the regulator has sent Dunamu an inspection opinion letter following a review of the incident.

The letter effectively opens the next stage of enforcement. It also gives Dunamu an opportunity to respond to the inspection findings before the FSS moves to notify the company of any proposed sanctions.

Key takeaways

• The FSS has reportedly issued an inspection opinion letter to Dunamu, kicking off a sanctions procedure after Upbit’s November 2025 $36 million hack.
• Yonhap reported that regulators are assessing whether Upbit violated the Virtual Asset User Protection Act, even though the law reportedly lacks direct penalties for cyberattacks and computer hacks.
• Upbit previously said it reimbursed affected customers using its own balance sheet funds and froze certain assets after the breach.
• Authorities are also weighing changes to South Korea’s Digital Asset Basic Act to add sanctions and compensation provisions for hacking and system failures.
• Upbit said it upgraded its wallet infrastructure after the incident and later introduced an automatic onchain tracing service intended to support recovery efforts.

FSS inspection letter launches enforcement step

Yonhap News reported Sunday that the FSS recently sent Dunamu an inspection opinion letter connected to the $36 million exploit that affected Upbit in late November 2025. The report frames the letter as the formal start of a sanctions process, with Dunamu able to respond to the findings before the regulator issues details of any proposed penalties.

The FSS is assessing whether the exchange breached the Virtual Asset User Protection Act. However, Yonhap noted that the statute does not provide direct sanctions provisions specifically for cyberattacks or computer hacking incidents.

This creates a compliance pressure point for exchanges and operators in South Korea: even when losses originate from security failures outside traditional financial market conduct, regulators are still attempting to map the incident to existing consumer protection obligations.

Criticism focused on delayed disclosure

Yonhap said Upbit faced criticism for delaying its announcement of the $36 million hack. The breach reportedly lasted about 54 minutes, beginning at 4:42 a.m. KST on November 27, but Upbit did not publicly disclose the incident until the end of the day.

The timing of the public disclosure, according to Yonhap, coincided with a merger-related event involving Naver Financial, after which the exchange finally announced the exploit. The regulatory review described in the report suggests that disclosure timing—along with incident handling—may be a key part of the FSS’s evaluation under the user protection framework.

Cointelegraph said it approached Dunamu for comment on the matter. No further response is included in the provided text.

Regulatory gap and proposed legislative changes

Yonhap also reported that South Korean authorities are considering how to address the current legal gap. The outlet said officials plan to add sanctions and compensation provisions for hacking and computer system failures into the second phase of the Digital Asset Basic Act.

For market participants, the significance is practical: a clearer statutory basis could shift enforcement from interpretive reviews—such as whether a hack violates broader user-protection obligations—to direct, incident-specific penalties and compensation duties. In other words, the likely focus may expand from “did the operator comply with existing rules?” to “did the operator meet explicit standards designed for cyber incidents?”

Until those amendments take effect, operators may remain exposed to enforcement theories rooted in consumer protection and operational responsibility, even where the law lacks cyberattack-specific sanction language.

Upbit’s response: reimbursements, wallet overhaul, and tracing

Upbit’s public response to the November 2025 exploit emphasized customer reimbursement and infrastructure changes. In a statement released after the incident, the exchange said it froze roughly 2.3 billion won (about $1.5 million) worth of funds. Upbit also said it would fully reimburse affected customers using its own balance sheet assets.

Separately, Upbit said it initiated an overhaul of its crypto wallet architecture after the exploit and migrated all assets from the wallets implicated in the incident. The exchange’s stated objective was to reduce exposure to potential vulnerabilities that could allow similar attacks to succeed.

In December 2025, Upbit said it developed an automatic onchain tracking service called the Onchain AI Tracer System, intended to trace the path of stolen funds and support recovery efforts.

These operational updates matter in the regulator’s context because they may influence how authorities assess whether Upbit took adequate steps both immediately after the breach and in the subsequent months. Even when reimbursement addresses direct user losses, regulators may still consider whether changes demonstrate robust incident prevention, transparent communication, and effective post-incident controls.

Upbit also ranks among the larger spot crypto exchanges in South Korea and globally, according to CoinMarketCap’s exchange rankings, which use scoring that includes traffic, liquidity, and trading volume.

Going forward, the key development to watch is Dunamu’s response to the FSS inspection opinion letter, since it will shape what sanctions—if any—are ultimately proposed. At the same time, traders and users should monitor the legislative process around the Digital Asset Basic Act’s next phase, because any move toward explicit hacking-related sanctions and compensation could materially alter how compliance is judged after major security incidents.