{{articledata.title}}

- Upbit found a wallet flaw while probing a $30M breach tied to Solana assets

- Weak signatures in past transactions triggered a full system audit and fixes

- Regulators opened an inquiry as Upbit prepares to restore services

South Korean cryptocurrency exchange Upbit is carrying out an expanded review of its internal systems after uncovering a wallet vulnerability during its investigation into this week's $30 million security breach.

The discovery, which the company says was unrelated to normal blockchain processes, has prompted a full reassessment of its transaction infrastructure, signature-generation tools, and hot-wallet security procedures.

Signature Patterns Trigger Internal Audit

Upbit said the issue surfaced as investigators examined irregular withdrawals detected on November 27 across several Solana (CRYPTO: $SOL ) ecosystem assets. During a broader assessment of network components and wallet architecture, analysts identified a flaw in internal wallet software that produced weak signature data under certain conditions.

According to the exchange, those weaknesses created a limited set of transactions in which predictable signature patterns appeared, possibly enabling observers to infer portions of certain private keys mathematically.

The company noted that private keys remain concealed under standard blockchain usage and said the weakness did not appear in typical activity. However, the review showed that earlier transactions contained signature data that did not meet intended security standards, prompting immediate remediation.

Security Response and Containment Measures

Upbit's security team patched the flaw shortly after detecting the anomaly and initiated an emergency plan that included halting deposits and withdrawals. Remaining funds in the affected wallets were migrated to cold storage as a precaution, and the company began reconstructing segments of its wallet infrastructure to prevent further exposure.

The exchange confirmed that losses totaled about 44.5 billion KRW, or roughly $30 million. Of that amount, customer-linked assets represented approximately 38.6 billion KRW (around $26 million). Upbit said it has already frozen an additional 2.3 billion KRW, or nearly $1.5 million, associated with unauthorized transactions. Company officials stated that all affected customers will be reimbursed from internal reserves.

Authorities Review Incident as Exchange Prepares Service Reopening

Regulators in South Korea have opened an inquiry into both the unauthorized outflows and the system flaw disclosed by the exchange. Investigators are reviewing transaction data and the conditions that allowed the vulnerability to appear.

However, Upbit stated that trading services will resume after a final inspection of its wallet systems and related infrastructure. The exchange, operated by fintech firm Dunamu, which is preparing for a merger with Naver as part of a planned listing, reported that the breach has not affected ongoing corporate processes.