Upbit Hack Response: Exchange Secures 99% of Funds Offline in Major Security Win
Cold wallets just saved the day—again.
When a major exchange faces a security breach, the immediate question isn't about the hack itself, but about the damage. In the latest incident, the response protocol wasn't just good; it was decisive. The exchange didn't just react—it executed a pre-planned defense that locked down the vast majority of assets before they could be touched.
The Offline Lifeline
This is the core of modern crypto security: keep what you don't need for daily trading completely disconnected. The strategy is simple, brutal, and effective. When the digital alarms blared, the hot wallet—the small, internet-connected portion—took the hit. The real treasure, however, was already sleeping soundly in deep freeze.
A Number That Says It All
Ninety-nine percent. That's the figure that turns a potential catastrophe into a manageable incident. It's the difference between a headline about collapse and a case study in resilience. It represents the portion of total funds that were never online to be stolen, safeguarded by air-gapped hardware and procedural discipline. The remaining one percent? That's the calculated risk, the cost of doing business in a liquid market.
The New Standard for Survival
The lesson here isn't about preventing every attack—that's a fantasy. It's about containment. The architecture held. The breach was isolated to a single, limited segment of the total ecosystem. This is what separates professional custodians from amateur hour: designing a system where a breach doesn't mean a bankruptcy.
In traditional finance, they'd form a committee, issue a press release full of hollow reassurances, and maybe—just maybe—get around to fixing the problem years later. In crypto, the code either works or it doesn't. The money is either there or it's gone. This time, it was there. The cold storage worked as advertised, proving that in the digital arms race, the best offense is a fantastic, and very chilly, defense.
Upbit revealed that it will increase its cold wallet storage ratio to 99%, and remaining only 1% in hot wallets – the lowest hot wallet ratio among native digital asset exchanges. This exceeds South Korea’s VIRTUAL Asset User Protection Act requirement, which mandates that exchanges keep at least 80% of user funds offline.
Where most of the exchanges maintained cold wallet ratios between 82–90%, the exchange consistently led with 98.3%, by the end of October, 2025, and now further expanding that record to 99%.
Even after being on top spot, what ignites the platforms this much aggressive shift? Well, the answer is clear from last month’s threat.
Solana Hack Incident: Immediate Response and Asset Protection
On November 27, 2025, Upbit detected unusual withdrawals involving Solana-based tokens, including SOL, USDC, BONK, JUP, RAY, RENDER, PYTH, ORCA, TRUMP, ME, and others. Approximately 54 billion won ($38.6 million) was moved to an external storage, prompting Upbit to immediately suspend deposits and withdrawals.
A portion of the stolen funds, including Solaire (LAYER) worth about 12 billion won ($8.57 million), was already frozen on-chain. Remaining assets were swiftly secured in physical wallets, preventing further loss.
In response to this incident, the exchange is now shifting more public assets to the cold wallets. For context, a hot wallet connects to the internet to facilitate transactions, whereas a cold wallet is offline and considered far safer.
CEO Oh Kyung-seok stated, "We prioritize the protection of customer assets above all else and continuously strive to maintain the lowest hot-wallet usage in the country."
The Need of These Measures: Crypto Hack Trends in Recent Years
The solana incident highlights broader crypto security risks in 2025. According to the summarized report by Deepstrike:
2022 – 2023: Cryptocurrency losses fell ~54% after a peak of $3.8B in 2022.
2023 – 2024: Losses rose ~21% to $2.2B.
2025 1st half: Stolen funds reached ~$2.17B, nearly matching the full 2024 total.
Wallet takeovers accounted for a major portion of ~69% in the first half of 2025 losses (~$1.71B), while phishing caused ~16.6% by value (~$410.7M). Smart contract and operational breaches made up the remaining ~14.4%.
The data emphasizes the need for hardware-backed wallets, strict key management, and multi-layer security protocols for both exchanges and users.
Upbit’s Path Forward: Zero Hot Wallets
As part of a company-wide security overhaul, Upbit plans to reduce online storage usage to 0% in the future. This approach aims to safeguard users while enabling confidence in the exchange amid rising crypto adoption.
The platform’s proactive approach after the Solana hack underscores its position as South Korea’s most secure digital asset exchange. By maintaining 99% of funds in cold wallets and preparing to eliminate hot wallets entirely, the exchange reinforces user trust and sets a benchmark in crypto security.
