A major security incident at Upbit has revealed a striking imbalance between what hackers chose to drain in volume and where the real financial damage occurred, raising fresh questions about risk controls at South Korea’s largest exchange.
While more than 100 billion BONK tokens were stolen in last month’s breach, it was Solana (SOL), not BONK, that accounted for the largest monetary loss.
Regulatory data released by the Financial Supervisory Service (FSS) through Rep. Kang Min-kuk shows that attackers siphoned approximately 104.06 billion coins from Upbit between 4:42 a.m. and 5:36 a.m. on November 27, a 54-minute window in which 32 million tokens per second were drained, totaling about 44.5 billion won ($30.2 million).
Although BONK represented 99.1 percent of all stolen tokens, roughly 103.12 billion coins, its low market value meant the loss amounted to just 1.53 billion won, according to The Korea JoongAng Daily.
Solana, by contrast, accounted for only a fraction of the total token count but delivered the steepest financial blow: about 18.99 billion won, or 42.7 percent of the theft’s value.
Other losses included Pudgy Penguins (PENGU) (3.85 billion won) and Official Trump (TRUMP) tokens (2.92 billion won).
Upbit convened an emergency meeting at 5 a.m. and halted Solana-based transactions by 5:27 a.m., before freezing all digital asset activity at 8:55 a.m.
Also Read: Google Introduces Titans, The First AI System To Update Its Own Memory In Real Time
But the timeline shows a significant lag in notifying authorities.
The FSS was informed at 10:58 a.m., followed by the Korea Internet & Security Agency at 11:57 a.m., police at 1:16 p.m., and the Financial Services Commission at 3 p.m.
A public notice did not appear until 12:33 p.m.
Rep. Kang criticized the delay, noting that “a full investigation is needed to determine whether the fault lies with Solana’s platform structure or Upbit’s account management system.”
Legal ambiguity complicates the process. Korea’s existing virtual asset framework, including the 2023 user-protection law, does not specify penalties or compensation requirements for exchange hacks, limiting the outcomes of the FSS’s ongoing inspection.
Upbit said over 80% of customer funds were stored in cold wallets and that it absorbed the losses directly.
“Our focus was on halting further unauthorized withdrawals,” a spokesperson said. “We reported the incident as soon as the abnormal activity was confirmed to be a breach.”
Read Next: PwC: Hedge-Fund Crypto Exposure Surges To 55%, Up From 47% Last Year