Dunamu Faces Regulatory Sanctions Following Upbit Security Breach: Sources
The regulatory action unfolds amid ambiguity in South Korea's Virtual Asset User Protection Act, which currently provides no specific penalty framework for computer system breaches and hacking incidents, creating uncertainty around potential consequences.
The Financial Supervisory Service (FSS) of South Korea has delivered an inspection opinion letter to Dunamu, which operates the cryptocurrency trading platform Upbit, in connection with the November 2025 security breach that resulted in $36 million in losses.
According to a Sunday report from local media publication Yonhap News, the FSS recently transmitted the inspection opinion letter to Dunamu.
The delivery of this letter signifies the commencement of formal sanctions proceedings by the nation's financial regulatory authorities. The document grants Dunamu the ability to provide a response to the inspection's conclusions prior to receiving official notification regarding the sanctions the regulator intends to impose.
Cointelegraph has reached out to Dunamu seeking comment regarding this development.
According to Yonhap, Upbit drew criticism for its delayed disclosure of the $36 million security incident.
The security compromise persisted for approximately 54 minutes, beginning at 4:42 a.m. KST on November 27, yet Upbit delayed its public disclosure of the incident until late in the day, waiting until after the completion of a merger-related event that involved internet technology company Naver Financial.
The FSS indicated it is examining whether the cryptocurrency exchange breached the Virtual Asset User Protection Act, legislation that currently contains no explicit penalty provisions pertaining to computer system compromises or cyber intrusions.
According to the report, regulatory authorities in South Korea intend to close this legislative gap by incorporating sanctions and compensation requirements for cyber intrusions and computer infrastructure failures into the second iteration of the Digital Asset Basic Act.
Upbit compensates affected users, implements onchain monitoring infrastructure for asset retrieval
In an official statement released after the November security incident, Upbit disclosed that it had frozen assets worth approximately 2.3 billion won ($1.5 million). The trading platform committed to providing complete reimbursement to impacted users utilizing its own company reserves.
Following the security breach, Upbit announced it had launched a comprehensive restructuring of its cryptocurrency wallet infrastructure to eliminate potential security weaknesses and transferred all digital assets from the compromised wallets.
In December 2025, Upbit revealed the creation of an automated blockchain tracking platform, the Onchain AI Tracer System, designed to monitor the movement of the misappropriated assets and support potential retrieval operations.
Based on metrics that encompass user traffic, market liquidity and transaction volumes, Upbit holds the third position in CoinMarketCap's rankings of cryptocurrency spot trading platforms.