South Korean Regulators Launch Sanctions Against Dunamu Following $36M Upbit Hack

South Korea’s Financial Supervisory Service (FSS) has officially launched a sanctions procedure against Dunamu, the operator of the major crypto exchange Upbit, following a devastating $36 million hack in November 2025. By issuing an inspection opinion letter, the FSS has formally initiated the regulatory crackdown, granting Dunamu a window to respond to the findings before final penalties are imposed.

The investigation highlights a significant regulatory gap within South Korea’s Virtual Asset User Protection Act, which currently lacks explicit sanction provisions for hacking and computer system breaches. As authorities navigate this legal ambiguity, the outcome of this case will likely shape the future of crypto regulation and exchange liability in one of the world's most active digital asset markets.

The proceedings underscore a critical vulnerability in the current legal framework: South Korea’s Virtual Asset User Protection Act lacks explicit sanction provisions specifically tailored for hacking and computer system incidents. This leaves the scope of potential penalties uncertain, creating a high-stakes environment for the exchange as regulators attempt to define accountability in the wake of major cybersecurity failures.