Binance Denies Delaying Response in Upbit Hack Case Amid South Korean Investigations
Binance has denied claims that it delayed or partially complied with requests from South Korean authorities to freeze funds related to the Upbit hack. A spokesperson for Binance stated that the exchange acted immediately upon identifying the incident and cooperated fully with law enforcement to freeze related transfers and mitigate further movements. These claims of delay have been described as unsubstantiated by Binance.
South Korean investigators have reported that only about 17% of the stolen assets have been frozen. The hackers quickly dispersed the stolen funds across more than 1,000 wallets within hours of the breach, which occurred on November 27. Authorities further noted that a significant share of the laundered assets eventually reached Binance service wallets. Specifically, around 470 million won (~$370,000) worth of Solana tokens were requested to be frozen, yet only about 80 million won (~$75,000) were actually frozen due to verification processes.
The incident involved a $30 million Solana hot-wallet breach at Upbit, an exchange operated by Dunamu. Upbit responded by moving 99% of customer assets to cold storage following the breach and plans to maintain or raise the cold storage ratio to minimize exposure to hot wallets. Reports indicated that just prior to the breach, at the end of October, Upbit already held approximately 98.33% of assets in cold storage, underscoring a strong pre-breach security posture compared to domestic exchanges.
Early intelligence assessments cited in local reports have linked the intrusion to North Korea’s Lazarus Group. The rapid movement of funds by hackers has complicated recovery efforts, according to investigators.
