Korean Officials Say Binance Froze Only a Fraction of Funds From Upbit Hack
Korean authorities say Binance froze only a small portion of the crypto stolen in last month’s Upbit hack, despite urgent requests from both police and the exchange to stop the movement of the stolen funds.
Key Points
Binance froze just 17% of the flagged stolen funds.
Hackers used complex cross-chain laundering techniques to scatter the assets.
Most of the funds eventually ended up in Binance service wallets.
Korean experts say exchanges need faster, coordinated freeze systems to limit losses.
Hackers Used a Sophisticated Laundering Strategy
According to investigators, only 17% of the assets Upbit and police asked Binance to freeze were actually locked down. Analysts say the hackers spread the stolen crypto across more than 1,000 wallets on the morning of November 27, breaking the funds into smaller pieces, hopping between chains, and using bridges and swaps to hide their trail.
Authorities say most of those laundered funds eventually arrived in Binance service wallets.
Upbit and the police had requested an immediate freeze on roughly 470 million won (~$370,000) worth of Solana they confirmed had reached Binance. But Binance froze only 80 million won (~$75,000), saying it needed more verification before taking broader action.
The freeze was not confirmed until around midnight, roughly 15 hours after the initial request.
When questioned by Korean broadcaster KBS about the delay and the limited freeze, Binance declined to give specifics, citing its policy on active investigations. The company said only that it is cooperating with authorities under proper procedures.
Experts Criticize Slow Response
South Korean security experts say the situation highlights a major problem: exchanges are often too slow to freeze hacked funds.
Cho Jae-woo, head of the Blockchain Research Institute at Hansung University, said quick freezes are crucial to preventing large losses.
“Exchanges often hesitate because of legal risks,” he said, adding that the industry may need a global emergency hotline or a coordinated body with authority to impose immediate freezes during major hacks.
Investigators also say most of the stolen funds have now been converted from Solana to Ethereum, likely to improve liquidity due to Ethereum’s deeper trading markets.
Upbit Responds With Massive Security Shift
After losing 44.5 billion won (~$30 million) from its Solana hot wallet, Upbit is moving 99% of customer funds into cold storage, one of the strongest safety measures ever taken by a major exchange.
Operator Dunamu said the platform is reducing hot-wallet exposure to nearly zero—well above Korea’s requirement that 80% of assets be kept offline.
Upbit already had 98.33% of user assets in cold storage by late October, but accelerated the transition after the breach.
Meanwhile, Korean authorities are investigating the attack. Early intelligence assessments reported by local media suggest potential ties to North Korea’s Lazarus Group, one of the world’s most notorious hacking organizations.
