Ethereum Updates: Lazarus Group's Cross-Chain Theft Reveals Vulnerabilities in Crypto Exchanges
- South Korean authorities attribute Upbit's $30M hack to North Korea's Lazarus Group, using multi-chain laundering via Solana and Ethereum . - Attack mirrored 2019 incident, targeting admin accounts, intensifying scrutiny of Dunamu’s $35.2B fine and merger with Naver. - Hack occurred during Dunamu-Naver merger announcement, raising suspicions of disruption intent, aligning with Lazarus’s geopolitical tactics. - North Korea’s sanctions-driven cyberattacks highlight global risks as Lazarus evolves tactics,
Upbit Crypto Exchange Hack Attributed to North Korea’s Lazarus Group
South Korean officials have traced the recent $30 million cyberattack on the cryptocurrency platform Upbit to the Lazarus Group, a notorious hacking collective associated with North Korea’s intelligence services. The incident, which took place on November 27, involved sophisticated laundering strategies that spanned multiple blockchains.
Attackers utilized both Solana and Ethereum networks to move the stolen funds, quickly distributing assets across 185 different wallets and converting them into ETH within a matter of hours. This approach closely resembled tactics seen in a 2019 Upbit breach, where 342,000 ETH were stolen, further reinforcing suspicions about Lazarus’s involvement. Authorities believe the hackers likely gained access by compromising or impersonating administrator accounts, rather than breaching the servers directly—a method consistent with previous Lazarus operations.
The breach has led to increased regulatory pressure on Dunamu, Upbit’s parent company, which is now facing a record penalty of 35.2 billion won due to delayed incident reporting and issues with data management. The hack also casts uncertainty over Dunamu’s $10.3 billion merger with Naver, announced on the same day as the attack. Regulatory bodies have suspended license renewals for major Korean exchanges for over a year, adding to Dunamu’s challenges. In response, Upbit has promised to fully reimburse affected customers, temporarily halted Solana network transactions, and transferred 70% of its assets to cold storage to enhance security.
Blockchain analysis has highlighted the complexity of the operation. The perpetrators bridged stolen assets from Solana to Ethereum using tokens and liquidity pools on platforms such as Allbridge. While the rapid movement of funds left some traces, the cross-chain mixing made tracking the assets more difficult. The Financial Services Commission has now designated user transaction data as sensitive under the Credit Information Act, intensifying its investigation into Upbit’s security protocols.
Merger Disruption and Strategic Timing
The timing of the hack has drawn attention, coinciding with the announcement of the Dunamu-Naver merger—a move intended to strengthen South Korea’s cryptocurrency sector. Some analysts suggest the attack was deliberately timed to undermine the merger, with the hackers possibly aiming to make a statement during a major industry event. This theory aligns with the Lazarus Group’s history of targeting vital economic infrastructure, especially during periods of heightened geopolitical tension.
Broader Implications and Ongoing Investigations
North Korea’s dependence on cybercrime to generate foreign currency provides further context for the breach. Facing stringent international sanctions, the country’s hacking units have increasingly targeted digital assets, with Lazarus previously implicated in significant thefts both in South Korea and worldwide. In response to the Upbit incident, the Korea Internet & Security Agency (KISA) and financial regulators have launched urgent inspections, highlighting the seriousness of the situation.
As the investigation unfolds, the breach exposes ongoing vulnerabilities in the security and oversight of cryptocurrency exchanges. Upbit’s repeated security failures—in both 2019 and 2025—raise concerns about the effectiveness of protections for hot wallets and cross-chain transactions. Meanwhile, the Lazarus Group’s evolving techniques, particularly their rapid multi-chain laundering, continue to pose a significant risk to the global digital asset ecosystem.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
XRP News Today: ADGM's Green Light Boosts RLUSD as a Link Between the U.S. and Middle East
- Ripple's RLUSD stablecoin gains ADGM approval as UAE's first regulated fiat-referenced token, enabling institutional use in payments and collateral management. - With $1.2B market cap and 80% supply on Ethereum , RLUSD's adoption accelerates through transparent reserves and NYDFS compliance, bridging U.S.-Middle East markets. - ADGM's stringent framework attracts major institutions, positioning RLUSD as infrastructure-grade asset with 1:1 USD backing and third-party attestations. - Ripple expands regiona

Bitcoin News Update: Exchanges Compete With Crypto Perpetuals to Regain Importance Among Institutions
- Stock exchanges like SGX and Qatar bourses face pressure to adopt crypto perpetual futures (perps) to retain institutional relevance amid $187B+ global daily trading volumes. - SGX's Nov. 24 Bitcoin/Ethereum perps launch reflects traditional finance's integration with crypto, as $57.7B+ daily Bitcoin perp volumes outpace traditional offerings. - Gulf markets show mixed adaptation: Qatar's Ooredoo QPSC secondary offering contrasts with UAE's $5B+ in 2024 secondary sales, while China's property crisis expo

CME Group Halts Trading Across Futures Options Commodities and Currencies After Major System Failure

BitMine Adds 14,618 ETH as Corporate Holdings Pass 3% of Total Ethereum Supply
