South Korea weighs penalties for Upbit operator after $32M hack

South Korea’s financial watchdog has kicked off sanctions procedures against Dunamu, the operator of crypto exchange Upbit, following a $32 million hack last year.

Yonhap News reported July 19 that the Financial Supervisory Service (FSS) recently sent an inspection opinion letter to Dunamu. The move comes seven months after the regulator launched its probe into the November 2025 breach, which saw 44.5 billion won worth of Solana-network assets drained from the exchange.

Dunamu says it froze and recovered 2.6 billion won ($1.9 million) of the stolen funds. The remaining 38.6 billion won ($27.8 million) was fully covered using Upbit’s own reserves. But the FSS is now reviewing whether the exchange violated the Virtual Asset User Protection Act – a law that took effect in 2024.

Here is the twist. South Korea’s current legal framework does not contain direct penalty provisions for hacking incidents or system failures. That means even if the FSS finds Dunamu at fault, the sanctions may be light. The regulator plans to give the company advance notice of its sanctions recommendation after Dunamu completes its response process.

Final penalties will only be set after deliberations by the sanctions review committee, the Securities and Futures Commission, and the Financial Services Commission. That multi-step process could take weeks or months.

For traders, the immediate fallout is limited. Upbit users have already been made whole, and trading remains normal. But the case sets a precedent. How South Korea treats its largest exchange after a major exploit will indicator the country’s enforcement posture under the new user protection law.

Watch for the FSS’s formal sanctions recommendation and the subsequent committee decisions. Those will determine whether Dunamu faces a fine, a business suspension, or something else entirely.