What happened
On November 27, 2019, Upbit reported that 342,000 ETH, then worth about $50 million, was transferred from an exchange hot wallet to an unknown address without authorization. Upbit said customer assets were not lost and that deposits and withdrawals were suspended during the response.
Technical root cause
The confirmed issue was unauthorized control of a hot-wallet signing path. Public government and exchange materials do not prove whether this resulted from private-key theft, infrastructure compromise or insider action, so the entry mechanism remains unknown.
How it happened
- An unauthorized transaction moved 342,000 ETH from Upbit’s hot wallet.
- Upbit transferred remaining exchange assets to cold storage and paused deposits and withdrawals.
- The receiving address was publicly traceable, but the attacker’s initial access method was not established in the reviewed official materials.
- Upbit later resumed services after internal controls and monitoring were reviewed.
Protocol details
Classification
CeFi / Key Compromise
Protocol Type
Exploit/Access control
Protocol links
Website
@upbitglobal
Evidence
- report Report upbit.com
- analysis DeFiLlama defillama.com
- analysis Cyberattack on Upbit cryptocurrency platform newsd.admin.ch
- analysis Upbit service notice archive upbit.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
