Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnSquareMore
Ethereum Updates: Lazarus Group's Cross-Chain Theft Reveals Vulnerabilities in Crypto Exchanges

Ethereum Updates: Lazarus Group's Cross-Chain Theft Reveals Vulnerabilities in Crypto Exchanges

Bitget-RWA2025/11/28 08:36
By:Bitget-RWA

- South Korean authorities attribute Upbit's $30M hack to North Korea's Lazarus Group, using multi-chain laundering via Solana and Ethereum . - Attack mirrored 2019 incident, targeting admin accounts, intensifying scrutiny of Dunamu’s $35.2B fine and merger with Naver. - Hack occurred during Dunamu-Naver merger announcement, raising suspicions of disruption intent, aligning with Lazarus’s geopolitical tactics. - North Korea’s sanctions-driven cyberattacks highlight global risks as Lazarus evolves tactics,

Upbit Crypto Exchange Hack Attributed to North Korea’s Lazarus Group

South Korean officials have traced the recent $30 million cyberattack on the cryptocurrency platform Upbit to the Lazarus Group, a notorious hacking collective associated with North Korea’s intelligence services. The incident, which took place on November 27, involved sophisticated laundering strategies that spanned multiple blockchains.

Attackers utilized both Solana and Ethereum networks to move the stolen funds, quickly distributing assets across 185 different wallets and converting them into ETH within a matter of hours. This approach closely resembled tactics seen in a 2019 Upbit breach, where 342,000 ETH were stolen, further reinforcing suspicions about Lazarus’s involvement. Authorities believe the hackers likely gained access by compromising or impersonating administrator accounts, rather than breaching the servers directly—a method consistent with previous Lazarus operations.

The breach has led to increased regulatory pressure on Dunamu, Upbit’s parent company, which is now facing a record penalty of 35.2 billion won due to delayed incident reporting and issues with data management. The hack also casts uncertainty over Dunamu’s $10.3 billion merger with Naver, announced on the same day as the attack. Regulatory bodies have suspended license renewals for major Korean exchanges for over a year, adding to Dunamu’s challenges. In response, Upbit has promised to fully reimburse affected customers, temporarily halted Solana network transactions, and transferred 70% of its assets to cold storage to enhance security.

Blockchain analysis has highlighted the complexity of the operation. The perpetrators bridged stolen assets from Solana to Ethereum using tokens and liquidity pools on platforms such as Allbridge. While the rapid movement of funds left some traces, the cross-chain mixing made tracking the assets more difficult. The Financial Services Commission has now designated user transaction data as sensitive under the Credit Information Act, intensifying its investigation into Upbit’s security protocols.

Upbit Hack Investigation

Merger Disruption and Strategic Timing

The timing of the hack has drawn attention, coinciding with the announcement of the Dunamu-Naver merger—a move intended to strengthen South Korea’s cryptocurrency sector. Some analysts suggest the attack was deliberately timed to undermine the merger, with the hackers possibly aiming to make a statement during a major industry event. This theory aligns with the Lazarus Group’s history of targeting vital economic infrastructure, especially during periods of heightened geopolitical tension.

Broader Implications and Ongoing Investigations

North Korea’s dependence on cybercrime to generate foreign currency provides further context for the breach. Facing stringent international sanctions, the country’s hacking units have increasingly targeted digital assets, with Lazarus previously implicated in significant thefts both in South Korea and worldwide. In response to the Upbit incident, the Korea Internet & Security Agency (KISA) and financial regulators have launched urgent inspections, highlighting the seriousness of the situation.

As the investigation unfolds, the breach exposes ongoing vulnerabilities in the security and oversight of cryptocurrency exchanges. Upbit’s repeated security failures—in both 2019 and 2025—raise concerns about the effectiveness of protections for hot wallets and cross-chain transactions. Meanwhile, the Lazarus Group’s evolving techniques, particularly their rapid multi-chain laundering, continue to pose a significant risk to the global digital asset ecosystem.

0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!

You may also like

CME Suspension: Global Market Vulnerabilities Revealed by Thermodynamic Constraints

- CME Group halted Globex trading on Nov 28, 2025 due to CyrusOne cooling system failure in Chicago, freezing 90% of global derivatives markets. - The outage caused erratic price swings in gold/silver and disrupted EBS forex platforms, exposing vulnerabilities in third-party data center reliance. - Despite post-holiday timing softening immediate impact, the incident highlighted systemic risks from thermodynamic limits in AI-era infrastructure. - CME faces pressure to build redundant systems as it expands c

Bitget-RWA2025/11/28 13:02
CME Suspension: Global Market Vulnerabilities Revealed by Thermodynamic Constraints

Turkmenistan's Approach to Cryptocurrency: Navigating Government Oversight and Public Confidence

- Turkmenistan will implement strict crypto regulations from 2026, requiring miner registration, exchange licensing, and anti-money laundering protocols under President Berdimuhamedov. - The framework mirrors Central Asian neighbors' approaches but prohibits anonymous transactions, national symbols in branding, and hidden mining operations. - While aligning with global crypto oversight trends, the law maintains state control over digital assets, raising questions about market viability amid Turkmenistan's

Bitget-RWA2025/11/28 13:02
Turkmenistan's Approach to Cryptocurrency: Navigating Government Oversight and Public Confidence

Ethereum Updates Today: Institutional Optimism Meets Technical Challenges: The Pivotal Moment for Crypto

- Ethereum and XRP face critical technical junctures on Nov 28, 2025, with ETH testing $2,500–$3,200 support and XRP hovering near $2.30 amid mixed signals. - Bitcoin's bearish trend (50-day EMA at $100,937) contrasts with JPMorgan's "tradable macro asset" designation, potentially attracting institutional capital. - Solana's BONK memecoin launches a physically-backed ETP on SIX Swiss Exchange, bridging meme coins and traditional markets amid SOL's $140 support risks. - Market dynamics highlight institution

Bitget-RWA2025/11/28 13:02
Ethereum Updates Today: Institutional Optimism Meets Technical Challenges: The Pivotal Moment for Crypto

How a Query from an Office Supplies Specialist Transformed a $12 Billion Trucking Approach

- A non-trucking board member's question prompted Ryder System to shift focus from leasing to targeting 80-85% of companies owning their own trucks. - The strategic pivot aligns with growing demand in long-haul freight driven by e-commerce, trade agreements, and tech innovations like IoT fleet management. - Industry consolidation and sustainability trends, including electric trucks, are reshaping competition as firms expand specialized services like temperature-controlled logistics. - Ryder's experience hi

Bitget-RWA2025/11/28 12:42
How a Query from an Office Supplies Specialist Transformed a $12 Billion Trucking Approach