Upbit Moves Nearly All Customer Assets Offline After $31 Million Solana Hack
A sudden theft from South Korea’s largest cryptocurrency exchange, Upbit, has prompted the platform to move almost all user assets into cold storage, a decisive security shift following a hack on its Solana hot wallet.
Hackers drained 44.5 billion won, roughly $31 million, from a connected wallet, pushing the exchange to overhaul its wallet infrastructure and drastically reduce hot wallet exposure.
How Cold Wallets Protect Investors From Online Threats
Cold wallets are digital storage solutions kept entirely offline, disconnected from the internet, making them far harder for hackers to access.
In contrast, hot wallets operate online to handle deposits and withdrawals in real time, but their connectivity makes them prime targets.
Upbit’s operator, Dunamu, revealed that as of the end of October 2025, 98.33% of customer assets were already held in cold storage, with only 1.67% in hot wallets.
The exchange now plans to push this ratio above 99%, effectively limiting hot wallet exposure to near zero.
Dunamu stated,
“We will prioritize the protection of customer assets as the top priority of Upbit’s operations and do our best to create a digital asset trading environment that can be used with confidence.”
The company has also confirmed that losses from the breach, which mainly affected Solana’s SOL, ORCA, RAY, and JUP tokens, will be fully reimbursed from the company’s own reserves.
The attack occurred over just 54 minutes and triggered immediate emergency measures, including halting transactions and moving remaining assets offline while forensic investigations commenced.
Why Upbit’s Cold Storage Ratio Sets It Apart
Under South Korea’s Virtual Asset User Protection Act, exchanges must keep at least 80% of deposits offline.
Upbit’s current cold wallet share of over 98% far exceeds this requirement, giving it the lowest hot wallet ratio among domestic exchanges.
By comparison, other local platforms maintain cold ratios ranging from 82% to 90%, according to data released by lawmaker Heo Young.
Globally, Upbit’s figures also compare favourably.
Coinbase stores approximately 98% of user funds offline, while Kraken keeps 95–97% in cold wallets.
Major exchanges such as OKX, Gate.io, and MEXC maintain about 95%, while Binance and Bybit highlight offline storage without specifying ratios.
Upbit’s target of sub-1% hot wallet holdings, if realised, would set a new benchmark internationally.
Could High Cold Wallet Reliance Affect Liquidity
A shift toward near-total cold storage does introduce potential trade-offs.
Moving assets out of cold wallets requires manual or semi-manual processes, which may slow withdrawal speeds during periods of high trading activity.
Analysts warn that South Korea’s closed crypto market—constrained by real-name bank accounts and limited foreign participation—could exacerbate local price divergences, the so-called “Kimchi premium,” if withdrawals are delayed.
Following last month’s hack, Upbit temporarily suspended withdrawals.
With minimal hot wallet reserves, arbitrage opportunities linking Korean and global markets were restricted, causing sharp price surges for several altcoins.
Despite these challenges, Upbit maintains that predictive modelling and system optimisation ensure sufficient liquidity for standard operations.
How Security Failures Are Shaping Regulation
The Solana wallet breach has caught the attention of South Korea’s Financial Services Commission, which is considering rules that would hold exchanges to bank-level liability standards.
Proposed measures could require mandatory compensation for hacking and system failures regardless of fault, similar to obligations under the country’s electronic financial transactions law.
Upbit engineers identified a potential weakness in wallet software that could allow private keys to be inferred from public blockchain data, though the exchange has not confirmed if this was exploited.
Dunamu’s response signals a broader view that hot wallet exposure is a systemic risk needing continuous mitigation, rather than a problem solved through patching alone.
Upbit’s Strategy Signals a Shift in Industry Security Practices
The exchange’s decision to move nearly all funds offline demonstrates a prioritisation of security over transaction speed.
By holding over 99% of assets in cold wallets, Upbit dramatically reduces the amount of cryptocurrency at risk in the event of a future breach, reinforcing user trust and potentially encouraging other exchanges to raise their security standards.
For investors, the metric provides a clear, quantitative indication of the exchange’s commitment to safeguarding digital assets.
Dunamu’s proactive approach, including full reimbursement of breach-related losses, positions Upbit as a leader in a market where security remains a critical concern for both regulators and users.
Anais
Kikyo
Catherine
Weatherly