Loss calculations are complete, and the accountability phase is just getting underway. South Korea’s Financial Supervisory Service (FSS) has initiated formal sanction procedures against Dunamu, the operator of Upbit exchange. The disciplinary action follows a series of violations tied to a system breach in November 2025.
The attack, which occurred on November 27, targeted Solana-based assets on Upbit. Following the final tally, total damages stood at 44.5 billion won, equivalent to $32 million - slightly below the exchange’s initial estimate of $36 million. In response to the incident, Upbit transferred remaining funds to cold wallets and suspended deposit and withdrawal services. The company claims it reimbursed affected users using internal corporate reserves.
The FSS has now delivered an inspection opinion letter directly to Dunamu’s offices. This marks only the initial step, granting the company room to respond before sanctions are finalized. The regulatory process remains lengthy, requiring review by the sanction review committee, followed by the Securities and Futures Commission, and ultimately reaching the Financial Services Commission.
Loopholes Shielding the Exchange
While regulatory actions appear decisive on the surface, enforcement authorities are holding a cracked instrument. The Virtual Asset User Protection Act does grant regulators the authority to oversee asset custody and customer protection safeguards.
The issue arises in the specific provisions. The law contains no specific penalty clauses governing hacking incidents or cybersecurity failures. The absence of such articles creates a major legal loophole that Dunamu could exploit to avoid full liability.
Concerns that sanctions may fail to stick are well-founded. In a separate case, the Financial Intelligence Unit fined Dunamu 35.2 billion won for neglecting anti-money laundering rules and customer verification requirements. Dunamu appealed the penalty, and the court overturned the majority of the fine citing similar legal gaps.
Complications for Share-Swap Deal
Even with the prospect of dodging some fines, the barrage of regulatory scrutiny has disrupted Dunamu’s operations. The company is currently pursuing a share-swap transaction with Naver Financial. Entangled in unresolved regulatory issues, the planned equity transfer had to be delayed until December 31.
The South Korean government is now drafting revisions. The next legislative phase of the digital asset framework will include specific regulations to address hacking incidents and exchange cybersecurity failures.
Exchange operators may win in court through statutory loopholes. But for retail users, when layered defenses can be breached and laws lack the teeth to enforce accountability, promises of security remain nothing more than promotional material.
Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
