Unusual Solana Outflow Sparks Immediate Alert
South Korea’s largest crypto exchange, Upbit, has suspended all Solana-network deposits and withdrawals after an unauthorized transfer worth about $38 million in Solana-based assets to an external wallet.
Crypto trading platform Upbit’s internal systems reported an unusual withdrawal of Solana-ecosystem-based tokens, including SOL, BONK, JUP, RAY, ORCA, RENDER, PYTH, and TRUMP.
According to an official announcement on November 27, Upbit halted all network activity within minutes. In response, engineers suspended every Solana-related service and transferred funds into cold wallets to prevent further exposure.
The exchange also carried out on-chain freezing procedures. So far, approximately ₩12 billion worth of LAYER tokens linked to the breach are already frozen.
Company Issues Full Reimbursement Guarantee
Dunamu CEO Oh Kyung-seok moved quickly to calm customers, guaranteeing that the entire loss would be covered using the company’s own holdings. Oh Kyung-seok added that user assets remain intact and protected, and members’ assets won’t be affected.
Moreover, the approach differs from that of several global exchanges that have previously imposed losses on users after similar incidents. Upbit’s guarantee aims to prevent market fear during a period of heightened regulatory attention.
Solana Market Reacts as Audit Continues
Solana’s network saw brief profit-taking as news of the breach spread. Solana-linked tokens, including RENDER, JUP, BONK, and PENGU, fell by more than 1% in early trading. The broader Solana market remains active after recent price gains. As of press time, Solana is trading at $142.85, with a daily range between $135.63 and $144.47.
Moreover, the breach occurred during Dunamu’s ongoing merger with Naver Financial and follows a recent enforcement action by the Financial Intelligence Unit. Earlier this month, the FIU fined Upbit $25 million and restricted onboarding for three months due to AML and KYC violations.
Upbit’s review will now determine how the attacker gained access to the wallets and whether the breach exploited infrastructure tied to a specific chain or a broader operational weakness. The exchange has not provided a restoration timeline but stated that normal services will resume once all systems have passed security verification.