South Korea Opens Sanctions Process Against Upbit Operator Dunamu

South Korea’s Virtual Asset User Protection Act requires exchanges to safeguard customer assets, but it does not expressly prescribe penalties for hacking or information-technology failures. That gap matters in the case of Upbit, the country’s largest crypto exchange, because any action against operator Dunamu may establish how far regulators can use existing rules to enforce cybersecurity and disclosure duties while lawmakers work on a broader digital-asset framework.

The Financial Supervisory Service was reported on July 19 to have sent Dunamu an inspection opinion letter, the first formal step in sanctions proceedings. Upbit lost 44.5 billion won ($30.4 million) of Solana-network assets in a breach on Nov. 27, 2025, carried out from 4:42 a.m. to 5:36 a.m. The FSS will hear Dunamu’s response before giving advance notice of any penalty; the scope and severity remain uncertain.