Upbit

Is Upbit safe?

Upbit is a reasonably safe place for a Korean resident to hold won and trade coins, mainly because Korean law does much of the work. Customer cash sits at a bank, most coins must be kept offline, and the operator, Dunamu, publishes audited accounts. The catch is the hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary: it has been emptied by attackers twice, in 2019 and again in November 2025. Both times Dunamu paid for the loss itself.

We score Upbit 68/100, level with Crypto.com and above offshore exchanges such as OKX. It loses points for the repeat thefts and for a 35.2 billion won anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary fine.

Two hacks, same weak point

On 27 November 2019 about 342,000 ether, worth around 58 billion won at the time, left an Upbit hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary. Korean police said in 2024 that North Korea's Lazarus group was behind it.

Six years later to the day, on 27 November 2025, tokens on the Solana network moved from an Upbit hot wallet to an address the company did not control. Upbit first put the loss at 54 billion won and then revised it to about 44.5 billion won (roughly $30 million). Chief executive Oh Kyung-seok said Dunamu would cover the full amount from its own assets. Government officials told reporters the method looked like 2019, probably a stolen or impersonated administrator account rather than a server attack, and that early evidence pointed to Lazarus again. Financial and science ministry teams opened inspections.

No customer lost coins either time, which keeps Upbit in our 60–79 band for repaid hacks. We put it near the bottom of that band because the same layer failed twice.

What Korean law protects

The Virtual Asset User Protection Act, in force since 19 July 2024, is one of the stricter exchange laws anywhere:

• Customer cash must be kept at a bank, separate from the exchange's money. If an exchange fails, the bank repays users directly.
• At least 80% of customer coins, by value, must be in cold walletsCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary.
• The exchange must hold the same coins, in the same amounts, that customers own.
• It must buy insurance or set aside a reserve to cover hacks and outages.

Dunamu's 2025 annual report shows 5.83 trillion won of customer cash held under its arrangement with K Bank and an 80 billion won reserve restricted to paying for hacks and system failures. That reserve is bigger than either of Upbit's thefts.

Audited accounts, not a Merkle tree

Dunamu is not listed, but it files annual and half-year reports with Korea's Financial Supervisory Service, and they are public on DART. Samjong KPMG gave a clean opinion on the 2025 accounts, which show equity of about 6.2 trillion won. Upbit has also had accountants check customer assets against balances regularly since 2018; a July 2024 review reported coin holdings of about 103% of what customers were owed.

What Upbit lacks is the kind of proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary that Kraken runs, where you can confirm your own balance was counted.

The FIU fine and the court case

Korea's Financial Intelligence UnitFinancial intelligence unitA national government agency that receives reports of suspicious transactions from banks and crypto firms and analyses them for money laundering.More in the glossary inspected Dunamu in August to October 2024. In February 2025 it banned new Upbit users from moving coins in or out for three months, citing deals with unregistered overseas exchanges, and sanctioned staff. The Seoul Administrative Court suspended the order in March 2025 and cancelled it on 9 April 2026, finding no intent or gross negligence.

Separately, on 6 November 2025 the FIU decided a 35.2 billion won fine for about 8.6 million breaches of customer checks, trading restrictions and suspicious-transaction reporting. Examples included accepting blurred or photocopied ID. Dunamu objected in February 2026, which sends the fine to a court review.

None of this involves missing customer money, but it is a weak compliance record for the market leader.

How to use Upbit more safely

1. Sign in with Upbit's own login and an authenticator, and treat calls claiming to be from Upbit or the police as fraud until you check. Dunamu runs a dedicated voice-phishing call centre because these scams are common.
2. Withdraw only to addresses you have registered, and test with a small amount first.
3. Keep long-term holdings in your own wallet. Upbit's hot walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary is the part that has failed.
4. Expect deposit and withdrawal pauses after any incident; do not rely on Upbit for money you may need the same day.

How we scored it

Reserves (80) and custody (78) are Upbit's strongest factors, thanks to audited filings and Korea's bank-custody and cold-storage rules. Legal record (55) is the weakest because of the FIUFinancial intelligence unitA national government agency that receives reports of suspicious transactions from banks and crypto firms and analyses them for money laundering.More in the glossary fine. Security history (65) reflects two repaid hot-walletHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary thefts.