Key Insights
- Binance froze only a small share of funds tied to the Upbit hack after police requests
- The stolen Solana assets were transferred to Ethereum before restrictions could be enforced.
- Upbit plans to store 99% of user assets offline after the security breach
South Korean authorities say Binance froze only a fraction of the cryptocurrency tied to last month’s hack of Upbit, despite an urgent request from police and the affected exchange to stop the movement of stolen assets. The response has raised questions about cross-border cooperation during fast-moving cybercrime cases in the crypto market.
Police Request Met With Partial Action
According to South Korean broadcaster KBS, investigators requested that Binance freeze approximately 470 million Korean won, or roughly $370,000, in Solana tokens believed to be connected to the hack. Binance ultimately blocked approximately $55,000, which is close to 17% of the requested total, after a delay of around 15 hours.
KBS reported that Binance cited the need for additional verification before acting on the request. The freeze was confirmed close to midnight on the day of the incident, hours after police first contacted the exchange. However, when questioned by KBS about the limited scope and timing, Binance declined to provide details, citing internal rules tied to ongoing investigations. The exchange stated that it continues to cooperate with authorities and partners in accordance with established procedures.
Hack Spurs Debate Over Emergency Responses
The breach at Upbit included unauthorised withdrawals of assets based on Solana of approximately 36 million, which led to a formal police investigation. Investigators later stated that most of the stolen assets were converted from Solana into Ethereum, a shift widely used to access deeper liquidity and faster trading routes.
The handling of the freeze has drawn criticism from experts in South Korea. Cho Jae-woo, director of Hansung University’s Blockchain Research Institute, said that rapid action is critical when hacks occur. He said delays increase the chance that assets will be moved or converted before controls are in place.
Cho added that the industry may need a global emergency channel or a coordinated body with authority to impose immediate freezes during crises.
Upbit Moves Assets Offline After Breach
In response, Upbit operator Dunamu announced a major change to its custody model. The platform plans to move nearly all customer assets into cold storage, raising the cold wallet ratio to 99% and cutting hot wallet exposure to almost zero. The shift exceeds South Korea’s legal requirement that at least 80% of user funds be stored offline.
Furthermore, Upbit already held 98.33% of assets in cold storage at the end of October, the highest level among domestic exchanges. The overhaul accelerated after hackers drained approximately 44.5 billion won, or nearly $30 million, from its Solana hot wallet.
