South Korea’s Financial Supervisory Service (FSS) has reportedly begun a formal sanctions process related to the November 2025 $36 million exploit on Upbit, the country’s major crypto exchange operated by Dunamu. According to Yonhap News, the regulator has sent Dunamu an inspection opinion letter following a review of the incident.

The letter effectively opens the next stage of enforcement. It also gives Dunamu an opportunity to respond to the inspection findings before the FSS moves to notify the company of any proposed sanctions.

Key takeaways

• The FSS has reportedly issued an inspection opinion letter to Dunamu, kicking off a sanctions procedure after Upbit’s November 2025 $36 million hack.
• Yonhap reported that regulators are assessing whether Upbit violated the Virtual Asset User Protection Act, even though the law reportedly lacks direct penalties for cyberattacks and computer hacks.
• Upbit previously said it reimbursed affected customers using its own balance sheet funds and froze certain assets after the breach.
• Authorities are also weighing changes to South Korea’s Digital Asset Basic Act to add sanctions and compensation provisions for hacking and system failures.
• Upbit said it upgraded its wallet infrastructure after the incident and later introduced an automatic onchain tracing service intended to support recovery efforts.

FSS inspection letter launches enforcement step

Yonhap News reported Sunday that the FSS recently sent Dunamu an inspection opinion letter connected to the $36 million exploit that affected Upbit in late November 2025. The report frames the letter as the formal start of a sanctions process, with Dunamu able to respond to the findings before the regulator issues details of any proposed penalties.

The FSS is assessing whether the exchange breached the Virtual Asset User Protection Act. However, Yonhap noted that the statute does not provide direct sanctions provisions specifically for cyberattacks or computer hacking incidents.

This creates a compliance pressure point for exchanges and operators in South Korea: even when losses originate from security failures outside traditional financial market conduct, regulators are still attempting to map the incident to existing consumer protection obligations.

Criticism focused on delayed disclosure

Yonhap said Upbit faced criticism for delaying its announcement of the $36 million hack. The breach reportedly lasted about 54 minutes, beginning at 4:42 a.m. KST on November 27, but Upbit did not publicly disclose the incident until the end of the day.

The timing of the public disclosure, according to Yonhap, coincided with a merger-related event involving Naver Financial, after which the exchange finally announced the exploit. The regulatory review described in the report suggests that disclosure timing—along with incident handling—may be a key part of the FSS’s evaluation under the user protection framework.

Cointelegraph said it approached Dunamu for comment on the matter. No further response is included in the provided text.

Regulatory gap and proposed legislative changes

Yonhap also reported that South Korean authorities are considering how to address the current legal gap. The outlet said officials plan to add sanctions and compensation provisions for hacking and computer system failures into the second phase of the Digital Asset Basic Act.

For market participants, the significance is practical: a clearer statutory basis could shift enforcement from interpretive reviews—such as whether a hack violates broader user-protection obligations—to direct, incident-specific penalties and compensation duties. In other words, the likely focus may expand from “did the operator comply with existing rules?” to “did the operator meet explicit standards designed for cyber incidents?”

Until those amendments take effect, operators may remain exposed to enforcement theories rooted in consumer protection and operational responsibility, even where the law lacks cyberattack-specific sanction language.

Upbit’s response: reimbursements, wallet overhaul, and tracing

Upbit’s public response to the November 2025 exploit emphasized customer reimbursement and infrastructure changes. In a statement released after the incident, the exchange said it froze roughly 2.3 billion won (about $1.5 million) worth of funds. Upbit also said it would fully reimburse affected customers using its own balance sheet assets.

Separately, Upbit said it initiated an overhaul of its crypto wallet architecture after the exploit and migrated all assets from the wallets implicated in the incident. The exchange’s stated objective was to reduce exposure to potential vulnerabilities that could allow similar attacks to succeed.

In December 2025, Upbit said it developed an automatic onchain tracking service called the Onchain AI Tracer System, intended to trace the path of stolen funds and support recovery efforts.

These operational updates matter in the regulator’s context because they may influence how authorities assess whether Upbit took adequate steps both immediately after the breach and in the subsequent months. Even when reimbursement addresses direct user losses, regulators may still consider whether changes demonstrate robust incident prevention, transparent communication, and effective post-incident controls.

Upbit also ranks among the larger spot crypto exchanges in South Korea and globally, according to CoinMarketCap’s exchange rankings, which use scoring that includes traffic, liquidity, and trading volume.

Going forward, the key development to watch is Dunamu’s response to the FSS inspection opinion letter, since it will shape what sanctions—if any—are ultimately proposed. At the same time, traders and users should monitor the legislative process around the Digital Asset Basic Act’s next phase, because any move toward explicit hacking-related sanctions and compensation could materially alter how compliance is judged after major security incidents.

South Korea’s Financial Supervisory Service (FSS) has reportedly moved to formally examine whether crypto exchange operator Dunamu, the parent company behind Upbit, breached local rules after a $36 million hack last November. Yonhap News reported Sunday that the regulator recently sent Dunamu an inspection opinion letter—an early step that starts a sanctions process and gives the company a chance to respond to the FSS’s findings before any penalties are proposed.

At the center of the inquiry is a regulatory question about how existing South Korean law applies to cyber incidents. According to the same report, authorities are also looking at a potential legislative fix that would add clearer sanctions and compensation provisions for hacking and computer system failures.

Key takeaways

• The FSS has sent an inspection opinion letter to Dunamu, the operator of Upbit, marking the start of a formal sanctions procedure, per Yonhap News.
• Dunamu is expected to respond to the regulator’s inspection findings before any proposed sanctions are issued.
• The probe is tied to a $36 million exploit reported by Upbit in connection with a breach that lasted about 54 minutes on November 27, 2025, though the announcement came later that day.
• South Korean authorities are reviewing whether the incident violated the Virtual Asset User Protection Act, which currently lacks direct provisions for cyberattacks or computer hacks.
• The report indicates plans to address that legal gap in a second phase of the Digital Asset Basic Act by adding sanctions and compensation related to system failures.

Regulator signals sanctions after the November Upbit exploit

Yonhap News said the FSS recently sent Dunamu an inspection opinion letter following the November 2025 hack tied to Upbit. The letter effectively initiates the regulator’s step-by-step sanctions process, starting with a formal assessment and allowing the exchange operator to reply before the FSS notifies the company of any proposed penalties.

The development matters for market participants because it frames the incident not just as a security lapse, but as a compliance issue under South Korea’s financial oversight. When regulators move from incident response to sanctions procedures, it typically signals heightened scrutiny over both operational controls and communications practices around material events.

Timing of Upbit’s disclosure comes under scrutiny

Yonhap also highlighted criticism directed at Upbit regarding the timing of its public disclosure about the $36 million exploit. The report states that the breach began at 4:42 a.m. KST on November 27, 2025 and lasted roughly 54 minutes. However, Upbit did not announce the hack until the end of the day.

Yonhap attributed the delayed announcement to the conclusion of a merger-related event involving Naver Financial. That detail underscores the potential tension between corporate event calendars and the expectations regulators and users may have for timely disclosure after a major security incident.

Legal gap: current law lacks direct cyberattack sanctions

According to Yonhap, the FSS is reviewing whether the exchange violated the Virtual Asset User Protection Act. The report specifically notes that the act does not contain direct sanction provisions for cyberattacks or computer hacks.

This is a significant point for investors and compliance teams: if the law does not clearly address hacking events, regulators may have to rely on broader consumer protection obligations or other compliance standards to justify penalties. That can lead to uncertainty about outcomes—especially while case-specific interpretations develop.

Yonhap added that South Korean authorities intend to reduce this ambiguity by proposing additions for sanctions and compensation related to hacking and computer system failures in the second phase of the Digital Asset Basic Act. In practical terms, that suggests policymakers want future regulatory enforcement to be more direct and standardized when similar incidents occur.

Upbit’s response after the breach: reimbursement and wallet changes

Following the November exploit, Upbit said it froze approximately 2.3 billion won (about $1.5 million) worth of funds and would fully reimburse affected customers using its own balance sheet, according to a statement published on the exchange’s website. Upbit said it would reimburse impacted users rather than leaving them to absorb losses.

In addition to reimbursement, Upbit said it initiated an overhaul of its crypto wallet architecture to address potential vulnerabilities identified in the aftermath of the incident. The exchange also stated that it migrated all assets from wallets considered affected.

The operator’s efforts extended into onchain monitoring as well. In December 2025, Upbit said it developed an automatic onchain tracking service called Onchain AI Tracer System. The stated purpose was to follow the path of stolen funds and support potential recovery efforts.

For traders and users, these actions are relevant because they indicate how Upbit has approached both immediate risk containment and longer-term incident response. Yet regulators may still evaluate whether controls were sufficient before the breach, how the incident was managed during the window of compromise, and how promptly users were informed.

Separately, Upbit is described as ranking third in CoinMarketCap’s spot exchange rankings, based on a scoring system that includes factors such as traffic, liquidity, and trading volumes, according to CoinMarketCap’s exchange rankings page.

What to watch as the inspection and sanctions process unfolds

With the FSS inspection opinion letter now in place, the next key development will be how Dunamu responds to the regulator’s findings and what compliance arguments it presents around disclosure timing, incident handling, and the applicability of existing law. Observers should also watch the legislative track Yonhap described—if the second phase of the Digital Asset Basic Act adds cyber-focused sanctions and compensation provisions, it could materially change how future security incidents are regulated in South Korea.

Zcash founder Zooko Wilcox has explained how the network’s July 28 Ironwood hard fork will address uncertainty around a critical flaw in the Orchard shielded pool.

The upgrade will not identify or freeze individual counterfeit coins. Instead, it will seal the old pool and limit how much ZEC can leave.

In a July 19 post on X, Wilcox explained how the planned upgrade would deal with any hidden excess supply if the flaw was exploited before developers patched it. Because Orchard hides transaction details, the network cannot prove that counterfeit ZEC was never created.

Ironwood will seal the vulnerable Orchard pool

Ironwood, also known as NU6.3, is scheduled to activate at block 3,428,143 on July 28. The upgrade will retire the current Orchard pool and introduce a new shielded pool based on the corrected circuit.

According to Zcash’s official Ironwood user update, users will no longer be able to send or receive ZEC inside the old Orchard pool after activation. Funds can leave only through the turnstile, which prevents more ZEC from exiting than legitimately entered.

The Zcash team said it believes the flaw was “unlikely to have been exploited,” but users cannot independently prove no counterfeit ZEC was created. Ironwood aims to trap any excess value inside the old pool rather than allow it to enter wider circulation.

Orchard bug left a supply question Zcash could not prove away

Security researcher Taylor Hornby discovered the Orchard flaw on May 29 while auditing the shielded system. The bug could have allowed an attacker to create counterfeit ZEC inside Orchard without leaving an obvious public record.

As reported by crypto.news, developers first disabled Orchard activity and then restored it through the NU6.2 hard fork with corrected cryptography. No evidence of unauthorized value creation was found, but Orchard’s privacy means past exploitation cannot be ruled out with complete certainty.

Crypto.news later reported that Ironwood would create a fresh shielded pool and use the turnstile to control value leaving the old one. Node operators can then verify that circulating ZEC does not exceed the amount permitted by the network’s monetary rules.

Wallets and exchanges may temporarily pause services

Zcash users do not need to take immediate action before the hard fork. However, wallets, exchanges and other providers may temporarily suspend deposits, withdrawals or related services while completing software upgrades.

The official network guidance says Orchard users will eventually need wallet support to move funds into the new pool. Funds may remain temporarily unavailable in wallets that have not added the required migration tools.

The July 28 activation also follows Zcash’s move away from the legacy zcashd client. Providers still completing that migration may need more time before fully supporting Ironwood.

Zcash adds more security checks after the flaw

The Orchard incident led to wider security work across the Zcash ecosystem. As reported by crypto.news, an AI-assisted review using Anthropic’s Mythos system found no additional serious vulnerabilities after the original flaw was disclosed.

Developers are also pursuing independent audits and formal verification for the updated cryptographic system. The work aims to reduce the risk of another hidden counterfeiting flaw and give users stronger ways to verify Zcash’s supply rules.

Ironwood addresses the unresolved supply question rather than the already-fixed bug itself. By sealing Orchard and controlling withdrawals through the turnstile, the hard fork aims to prevent any hypothetical counterfeit ZEC from entering circulation.

Circle President Heath Tarbert has defended the company’s long-term strategy after Circle shares fell sharply from their post-IPO peak.

Speaking in a July 14 interview with FOX Business, Tarbert said management remains focused on building financial infrastructure rather than reacting to short-term moves in the stock.

The interview came as Circle faced growing investor concern over competition in the stablecoin market. CRCL had traded near $260 after its public debut before falling toward the low $60 range. Tarbert said Circle is “playing the long game” and argued that successful execution would eventually support shareholder value.

Tarbert points to USDC network effects

Tarbert said Circle’s main focus remains building a full-stack internet financial platform around USDC and related infrastructure. He argued that the company’s position cannot be measured only through daily stock movements and said the stock should “take care of itself” if Circle delivers on its wider mission.

He also defended USDC against new competitors. Tarbert pointed to roughly $73 billion in circulation and native support across 34 blockchains, saying those network effects would be “incredibly hard to replicate.” Circle describes USDC as a regulated digital dollar used across trading, payments and settlement.

Open USD adds new pressure to Circle

The comments came after Open Standard launched Open USD, a planned stablecoin backed by more than 140 participating businesses. The group includes Visa, Mastercard, Stripe, BlackRock, BNY and Coinbase. Open Standard says partners can mint and redeem Open USD without fees and receive reserve earnings after a management charge.

As reported by crypto.news, Circle shares fell 17.5% to $62.63 after Open USD entered the market and CRCL left several Russell Growth indexes. The decline added to concerns about whether new stablecoin models could pressure Circle’s economics.

Wall Street has also raised questions about that competition. Crypto.news reported that Mizuho cut its Circle price target to $50, arguing that Open USD’s revenue-sharing structure could pressure margins and raise distribution costs.

Circle faces pressure over USDC economics

Circle’s challenge extends beyond new stablecoin issuers.JPMorgan lowered earnings forecasts for Circle and Coinbase after a new revenue-sharing agreement tied to USDC balances on Hyperliquid. The bank said stronger adoption could come with lower reserve income retained by the companies.

Tarbert pushed back on the idea that competitors can quickly reproduce USDC’s reach. He also described USDC as the largest regulated stablecoin and said it leads in actual transaction volume, presenting scale and existing distribution as key parts of Circle’s competitive position.

Circle keeps expanding regulated infrastructure

Circle has continued adding regulated infrastructure despite the stock decline. On July 10, the company received final OCC approval to establish Circle National Trust. The trust bank will initially provide digital asset custody, with USDC reserve management planned as a possible future service.

As reported by crypto.news, the approval places the new entity under direct federal supervision. Circle says the structure could support wider institutional use of its digital asset infrastructure.

Tarbert’s comments frame the stock decline against a wider contest for stablecoin distribution and reserve income. Open USD brings a large group of payment and financial companies into the market, while Circle continues betting that USDC’s existing network and regulated infrastructure will support its long-term position.

The Electronic Transactions Association (ETA) is signaling that Bitcoin may become a more visible part of mainstream payments conversations—at least within the group’s broader push to engage with emerging transaction technologies. ETA CEO Jason Oxman told CoinDesk that the organization is not lobbying for or against Bitcoin, but he suggested that ETA members are beginning to recognize its potential disruption in the payments stack.

The message comes as the ETA expands its membership base to include BitPay. On August 6, the trade group announced that BitPay—the Bitcoin payments provider—had become the first virtual currency company to join the ETA, framing the move as part of the industry’s ongoing innovation agenda.

Key takeaways

• The ETA’s Jason Oxman said the group does not take an official pro- or anti-Bitcoin stance and supports electronic transactions broadly, including non-Bitcoin technologies.
• BitPay’s entry as the ETA’s first virtual currency member is being presented by Oxman as evidence the trade group “won’t turn a blind eye to innovation.”
• Oxman pointed to education efforts around Bitcoin—specifically referencing the role of the Bitcoin Foundation—in shaping ETA members’ attitudes.
• On New York’s BitLicense proposal, Oxman argued regulators should avoid applying “reflexive” rules to new technology and instead conduct a deeper technical review of how Bitcoin systems and consumer protections work.
• New York’s financial regulator extended the public comment period for the BitLicense proposal by 45 days, pushing the deadline to October 21.

Why BitPay’s ETA membership matters

ETA represents major players in electronic payments, including companies such as Visa, MasterCard, Amazon, and PayPal. When Oxman discussed the ETA’s posture toward Bitcoin, he did not describe the trade group as endorsing a single technology. Instead, he framed the ETA’s mission around enabling electronic transactions in whatever form merchants and customers choose.

In that context, Oxman cited the ETA’s partnership with Atlanta-based Bitcoin payment solutions provider BitPay as a practical sign of openness. He suggested the organization is trying to position itself as a partner for emerging technology startups, with engagement driven largely by whether market participants show demand for those tools.

Oxman’s core argument was that transaction rails evolve according to user and merchant preferences. As he put it in his remarks, electronic transactions will take “whatever the customer or merchant of choice agrees is going to be the form of their electronic transaction.”

From education to partnerships

Oxman also linked the ETA’s shifting view to earlier learning efforts about Bitcoin. He said the Bitcoin Foundation played a significant role in educating ETA members about Bitcoin’s benefits and emphasized the value of business-oriented introductions between Bitcoin startups and established payment companies.

Specifically, Oxman referenced an ETA event in 2013 where Bitcoin Foundation general counsel Patrick Murck spoke. In Oxman’s recollection, Murck helped frame Bitcoin in business terms, after which Oxman said at least one ETA member decided to pursue a deal with a Bitcoin processor.

This detail matters because it suggests the ETA’s openness is not only policy-driven, but also influenced by how Bitcoin is presented—less as a speculative innovation and more as a payments system that can be integrated into existing commercial workflows.

What Oxman says about BitLicense and consumer protection

The ETA CEO’s comments also touched New York’s BitLicense framework, which has been at the center of ongoing debate about how cryptocurrency businesses should be regulated. Oxman said the ETA’s historical experience with regulatory change has involved adjusting to new payment options such as PayPal, noting that it previously spent significant effort encouraging regulators not to constrict innovation.

However, he acknowledged why regulators may be cautious with new payment technologies. His reasoning was that regulators tend to focus on consumer protection. According to Oxman, the less established the alternative system is—meaning the fewer protections are clearly available—the more regulators feel compelled to intervene.

Still, Oxman said the NY Department of Financial Services (NYDFS) should do more than react quickly to novelty. He argued regulators should not rely on “reflexive rules” simply because a technology is new, and instead conduct a real in-depth look at Bitcoin’s underlying systems.

In his view, the key is understanding how Bitcoin’s system operates, including how the blockchain works, and how Bitcoin providers—such as payment processors—can implement additional safeguards for consumers and merchants. The implication is that compliance standards should reflect the actual operating model and control points of Bitcoin-related businesses, rather than generic assumptions that could overreach.

Regulatory timeline shifts in New York

While ETA’s stance is aimed at engagement rather than advocacy, New York’s regulatory process is still unfolding. Earlier this week, NYDFS superintendent Benjamin Lawsky extended the public comment period on the BitLicense proposal by 45 days, pushing the deadline to October 21. This extension followed a joint letter addressed to Lawsky from BTC China, Huobi, and OkCoin, where the “Big three” exchanges outlined concerns about the proposal.

For industry participants, the practical takeaway is that the BitLicense debate remains active and that the regulatory outcome may depend on the arguments that emerge during the revised comment window. For Bitcoin-focused payments firms, that matters directly: the availability of licensing pathways and the scope of compliance requirements can influence whether and how businesses expand within New York.

As the ETA continues to bring Bitcoin payments into its orbit through members like BitPay and as New York works through its BitLicense process, readers should watch two things: whether regulators adopt a more technical, systems-level approach to consumer safeguards, and whether established payments networks deepen partnerships with Bitcoin-related processors as demand from merchants and customers becomes more visible.

South Korea’s Financial Supervisory Service has begun a formal sanctions process against Dunamu, the operator of crypto exchange Upbit, over the major wallet breach reported in November 2025.  

The action follows a months-long inspection into whether the exchange met its duties under the country’s Virtual Asset User Protection Act.

According to an SBS report citing financial authorities, the FSS recently sent Dunamu an inspection opinion letter. The document gives the company a chance to respond before regulators decide what penalties, if any, should follow. The process then moves through several formal regulatory review stages.

FSS reviews Upbit’s response to the 2025 breach

The November 27 attack affected Solana-based assets held by Upbit. Early estimates varied, with crypto.news reporting losses of about $36 million based on figures available at the time. South Korean reports now place the affected amount at 44.5 billion won, worth about $32 million at current exchange rates.

Upbit said it moved assets to cold wallets, halted deposits and withdrawals, and began tracing the stolen funds after detecting abnormal transfers. In its official customer notice, the exchange said customer losses would be covered with company funds. Authorities later examined both the security failure and the timing of Upbit’s public disclosure.

Legal gap makes the possible sanctions unclear

The current Virtual Asset User Protection Act gives regulators powers over custody, unfair trading and customer protection, but it does not set direct penalties specifically for hacking or computer system failures. That leaves uncertainty around how far the FSS can go in this case.

The regulator will consider Dunamu’s response before issuing advance notice of any proposed action. Final measures would require further review by the sanctions review committee, the Securities and Futures Commission and the Financial Services Commission. South Korean authorities are also considering stronger rules for hacking and technology failures in the next phase of digital asset legislation.

Upbit has faced wider regulatory pressure

The hack arrived during a period of close regulatory attention on Dunamu. As reported by crypto.news, South Korea’s Financial Intelligence Unit previously imposed a 35.2 billion won fine on the company over anti-money laundering and customer verification failures.

That earlier enforcement action later faced court scrutiny. Crypto.news reported that a court canceled a three-month partial suspension against Dunamu after finding gaps in the legal basis used for the sanction. The latest hacking case could create another test of how existing laws apply to crypto exchange operations.

Dunamu’s Naver deal remains under review

The sanctions process also comes while Dunamu works through a planned share swap with Naver Financial. the companies recently delayed completion of the transaction to December 31 because several regulatory approvals remain outstanding.

The current inspection does not automatically block that deal. However, Dunamu remains under several layers of regulatory review while South Korea prepares broader digital asset rules. The FSS has not yet announced a proposed sanction level in the hacking case, and Dunamu still has an opportunity to challenge the inspection findings before any final decision.