South Korean exchange Upbit had 342,000 ETH stolen from its hot wallet in a single unauthorized transaction.
Upbit's ETH hot wallet was compromised in a single transaction that transferred 342,000 ETH to an unknown address. The exchange suspended all deposits and withdrawals immediately. Upbit used company reserves to cover user losses and no customers were impacted financially. Post-incident, they migrated to cold storage for 70% of assets.
342,000 ETH began moving through multiple wallet hops immediately. The Ethereum community tracked the 'Upbit Hacker' address publicly. Portions sold via small amounts across multiple OTC desks to minimize price impact. ETH moved to Tornado Cash in batches over subsequent months. North Korean Lazarus Group later attributed by Korean cybersecurity agencies.
0xa2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b