Lazarus Group Suspected in $30M Upbit Hack

Alpha Team
November 28, 2025

🔓 Upbit Loses $30M in Hack

Hack Details and Impact: On November 27, Upbit identified unauthorized withdrawals from Solana hot wallets totaling $30.4 million (44.5 billion KRW). User losses amounted to 38.6 billion KRW, with 2.3 billion KRW frozen and 5.9 billion KRW covered by company funds. Deposits and withdrawals were suspended immediately, and remaining assets were transferred to cold storage. A Dunamu spokesperson confirmed that cold wallets remained unaffected and the incident was reported to authorities.

Lazarus Group Involvement: South Korean police suspect North Korea’s Lazarus Group due to tactics resembling the 2019 Upbit hack of 342,000 ETH (58 billion KRW). Funds were rapidly converted from Solana to USDC and bridged to Ethereum for laundering. CertiK noted the speed and scale align with known Lazarus patterns, though attribution remains preliminary. Authorities plan an on-site inspection and are tracing funds through addresses linked to previous North Korean attacks.

CEO Response and Fixes: Dunamu CEO Lee Sirgoo (Oh Kyung-seok) issued an apology, stating, “This intrusion resulted from inadequate security management at Upbit, and there is no excuse.” He confirmed full reimbursement of user losses from company reserves. A subsequent audit uncovered a private key vulnerability allowing inference from transaction signatures; the flaw has been patched. Upbit continues monitoring stolen funds and cooperating with law enforcement.

Crypto News

• Do Kwon, Terraform Labs co-founder, requests US court cap his prison sentence at five years; sentencing is scheduled for December 11th.

• ⭐️ Ethereum $ETH raises gas limit from 45M to 60M, increasing transaction capacity; adjustment was automatically applied after more than half of the validators signaled approval.

• ICYMI S&P Global $SPGI downgrades Tether’s $USDT to “5 (weak)”; cites increase in higher-risk assets in its reserves; Tether CEO Paolo Ardoino responded with "We wear your loathing with pride..."

• ICYMI Polymarket receives US CFTC approval for intermediation; to open US retail access & operate as a fully regulated US exchange.

Alpha

• ⭐️ MegaETH $MEGA to return all funds from Pre-Deposit campaign due to sloppy execution; says "depositor contributions will not be forgotten."

• Infinex $INX to launch Craterun on December 1st; to distribute INX vouchers, cash prizes, & more; earn crates by trading on Infinex Perps, importing wallets with historical perps activity, & more.

• Concrete launches Concrete Social Bags Campaign Phase 1; earn Concrete Points by completing quests.

• Yo launches 3x YO Points on all deposits from November 27th to December 1st; teases "last weekend to earn boosted points before the next chapter begins."

• ICYMI Fogo launches mainnet genesis; no dapps are live, though USDC transfers are open; infrastructure & validators are currently preparing for Fogo public launch.

Airdrops

• Binance $BNB launches $APRO HODLer Airdrop; BNB Simple Earn and/or BNB On-Chain Yields subscribers from November 4th to November 6th are eligible.

• Owlto $OWL to launch tge & airdrop within 3 months; 15% of token supply is allocated for airdrops; 1st snapshot taken on September 30th, 2024, 2nd snapshot to be taken before tge.

• Ten $TEN launches airdrop claim; wTENX holders & more were eligible to register.

• Reveel $REVA launches airdrop eligibility & allocation checker; Early Reva AI users, Pay(ID) claimers, & more are eligible.

• ICYMI Monad $MON launches mainnet, tge, & airdrop; tokens automatically distributed to wallets; 5.5K community members & 220K onchain were eligible to register.

Finance News

• CME Group markets were halted for several hours due to cooling issue at CyrusOne data centers; the markets have since resumed.

• ⭐️ Silver $XAG reaches new all-time high of ~$55; now up +90% in 2025.

• YZi Labs files preliminary consent statement to expand CEA Industries' $BNC Board of Directors; BNC currently holds 515,054 $BNB (~$461M).

• ICYMI Tether becomes the largest independent holder of Gold $XAU; holds 116 tonnes of gold (~$14B); only central banks own more.

• ICYMI Klarna $KLAR announces KlarnaUSD stablecoin; powered by Bridge's Open Issuance; to launch on Tempo in 2026.

Security and Exploits

• ⭐️ North Korea's Lazarus Group suspected in $30M Upbit hack; South Korean authorities to launch an on-site inspection of Upbit; affected users to be fully reimbursed.

• Balancer $BAL proposes to distribute $8M in recovered funds from recent $128M exploit; discussion is live on the Balancer Forum for feedback.

• Bubblemaps $BMT launches support for Monad $MON; users can now investigate Monad tokens, whales, & wallet clusters.

• ⭐️ Irys $IRYS distributes 20% of airdrop to single entity; the sybil used cluster of 900 identical wallets; no evidence linking Irys team to sybil wallets.

• OpenAI & CoinTracker disclose customer data breach via third-party Mixpanel; breach includes names, email addresses, approximate location, & more.

Token Unlocks

• Jupiter $JUP / ~$13M / NOV 28th
• Hyperliquid $HYPE / ~$343M / NOV 29th
• Zora $ZORA / ~$9M / NOV 30th
• Optimism $OP / ~$10M / NOV 30th
• Kamino $KMNO / ~$14M / NOV 30th
• Sui $SUI / ~$67M / DEC 01st
• EigenCloud $EIGEN / ~$23M / DEC 01st
• Ethena $ENA / ~$11M / DEC 02nd
Sourced from Tokenomist

Funding

• Nexton raises $4M in Strategic funding from several investors.

• ICYMI Revolut raises an undisclosed amount in funding at a $75B valuation led by Coatue, Greenoaks, Fidelity, & Dragoneer.

• ICYMI SpaceComputer raises $10M in Seed funding led by Maven11 & Lattice.

The Degen Farmer

Top stablecoin yield farms of the day, more than $3,000,000 in TVL. DYOR and step up your farming game!

PROTOCOL	ASSETS	APY
GrowiHF (Hyperliquid)	USDC	1117.82%
Hyperion (Aptos)	USD1USDC	166.52%
Peapods Finance (Ethereum)	USDC	42.14%
Uniswap V3 (Ethereum)	EUROCUSDC	30.32%
Superstate USCC (Ethereum)	USCC	24.00%
Fluid Lending (Polygon)	USDC	23.09%
Kinetic (Flare)	USD₮0	21.55%
Merkl (Ethereum)	LVUSDCUSDC	20.29%

. . .

☁️ EigenCloud: Verifiable Cloud & Ethereum Restaking

☁️ What is EigenCloud EigenCloud is a developer platform built on EigenLayer, Ethereum’s leading restaking protocol. Users restake ETH or EIGEN to secure DeFi, AI, and real-world applications. With over $20B in TVL and 162+ Actively Validated Services (AVSs) in development, it’s backed by a16z’s recent $170M investment. Join now: Restake to earn rewards (over $128M already distributed) or run nodes for AI inference and scaling. Just launched: Concrete’s Staked Eigen Vault delivers 8-10% real USD yield, Eigen incentives, partner rewards, and full DeFi composability.

🌉 EigenZero: Restaking for Interoperability EigenCloud and LayerZero just launched EigenZero, the first cryptoeconomically secured Decentralized Verifier Network (DVN). Powered by EigenCloud’s restaking and slashing infrastructure and backed by $5M in ZRO stake, it enforces accountability for cross-chain verifications. Verifiers face real penalties for failures. Over 600 LayerZero-integrated apps can now opt into Ethereum-grade security, while builders select verifiers based on stake, history, and performance. Each new DVN deepens EIGEN's role as the economic trust layer for verifiable interactions across chains.

🚀 EIGEN & x402: Early in the Stack Long before x402 became the standard for agent-to-agent (A2A) payments, EigenCloud shipped live verifiable workflows with Google’s AP2 in September. EigenCompute executes tasks with cryptographic proofs, EigenDA provides scalable storage for inputs and outputs across chains, and AVSs integrate trust directly into agent operations. Together, the x402 + AP2 + EigenCloud stack forms a complete verifiability layer, enabling secure, programmable interactions in the emerging agent economy.

👉 Deposit into Concrete’s Staked Eigen Vault and earn real yield today!

. . .

That’s it for today’s edition! See you soon.

Reply

or to participate.