Cyber Crime

Upbit cryptocurrency exchange hacked, crooks stole $48.5 million worth of ETH

Another South Korean cryptocurrency exchange was hacked, this time the victim is Upbit that lost $48.5 million in cryptocurrency.

The South Korean cryptocurrency exchange Upbit disclosed a security breach, the company told its customers that hackers have stolen $48.5 million in crypto-currency from its hot wallet. 

The company has halted its operations on Wednesday, customers were not able to operate with their wallets.

According to the data breach notification published by the company, hackers stole 342,000 in Ethereum (ETH), approximately $48.5 million at the time of writing, that were stored in the main hot wallet of the exchange.

“At 1:06 PM on November 27, 2019, 342,000 ETH (approximately 58 billion won) were transferred from the Upbeat Ethereum Hot Wallet to an unknown wallet. Unknown wallet address is 0xa09871AEadF4994Ca12f5c0b6056BBd1d343c029” reads the data breach notification published by the company.

At the time of writing, the wallet controlled by the attackers has 40 transactions for a total amount of 342,000 ETH worth of cryptocurrency.

Lee Seok-woo, chief executive of Doo-myeon that operates the Upbit exchange, declared that the company will completely cover the stolen funds and it will restore normal operations in a couple of weeks.

In response to the attack, the exchange has moved all its funds in the Hot Wallet to the Cold Wallet.

The exchange manager who handles cryptocurrency is also asking customers to prevent deposits from the Ethereum address that was involved in the security breach. The company recommends users to report any suspicious activity to the Upbit Customer Center.

Some Reddit users speculate that the incident could be not true and that the operators have made an exit scam.

On Reddit, some users have questioned the authenticity of the hack claim, which is no surprise given how often exchanges will say they have suffered a cyberattack, only to perform an exit scam. 

In the past, other South Korean crypto-currency exchanges suffered security breaches, in June 2018 hackers stole $31 Million from Bithumb and in a separate incident crooks stole over $40M worth of ICO tokens from Coinrail. In December 2017, South Korea cryptocurrency exchange Youbit shuts down after it was hacked two times in a few months.

In March 2019, Hackers stole $19 Million from Bithumb cryptocurrency exchange, the same exchange was already hacked in July 2017, when hackers stole over $1 Million worth Bitcoin and Ether stolen.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Upbit exchange, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Over 80,000 servers hit as Roundcube RCE bug gets rapidly exploited

A critical remote code execution (RCE) vulnerability in Roundcube was exploited days after patch, impacting…

8 hours ago

A flaw could allow recovery of the phone number associated with any Google account

A vulnerability could allow recovery of the phone number associated with a Google account by…

12 hours ago

Texas Department of Transportation (TxDOT) data breach exposes 300,000 crash reports

Hackers breached Texas DOT (TxDOT), stealing 300,000 crash reports with personal data from its Crash…

23 hours ago

SAP June 2025 Security Patch Day fixed critical NetWeaver bug

SAP fixed a critical NetWeaver flaw that let attackers bypass authorization and escalate privileges. Patch…

1 day ago

U.S. CISA adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds RoundCube Webmail and Erlang Erlang/OTP SSH server flaws…

1 day ago

Mirai botnets exploit Wazuh RCE, Akamai warned

Mirai botnets are exploiting CVE-2025-24016, a critical remote code execution flaw in Wazuh servers, Akamai…

1 day ago