Yapizon Hack

Reported loss $5.0M
Bitcoin
Other

What happened

Early on April 22, 2017, attackers emptied four hot wallets at Yapizon, a South Korean bitcoin exchange. Yapizon put the loss at 3,831 BTC, "equivalent to 37.08% of the total assets", then worth about $5 million. BleepingComputer, citing the exchange, reported 3,816.2028 BTC (over $5.5 million), or 36.594% of its bitcoin. Yapizon reported the theft to the Seoul Metropolitan Police's cyber investigation unit and denied any insider involvement. It has not said how the attackers got into the hot wallets.

Instead of covering the loss, Yapizon spread it across all customers, following Bitfinex's 2016 approach. It cut every account balance by the same percentage and issued "Fei" tokens as claims for later repayment. "The loss of 37.08% will have the same effect on all members' assets," the exchange said.

South Korean authorities later alleged North Korean involvement, and a 2023 UN panel report reportedly attributed both this theft and the December 2017 Youbit hack to North Korea. The exchange, renamed Youbit, was hacked again on December 19, 2017 and then filed for bankruptcy.

Protocol details

Classification CeFi / Key Compromise
Protocol Type Exploit/Other
Protocol links Website @yapizon

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.