Upbit disclosed 342,000 ETH loss from its hot wallet

South Korean cryptocurrency exchange Upbit said on November 27, 2019 that 342,000 ETH had been transferred from its Ethereum hot wallet to an address the company did not recognize. Upbit promised to replace the missing ether with company assets, suspended deposits and withdrawals, and moved other cryptocurrency held in hot wallets into cold storage.

The disclosure established a major exchange-custody failure, although it did not establish how the wallet was compromised or identify whoever controlled the receiving address. Contemporaneous reports described the event as a theft or cyberattack; Upbit’s notice focused more narrowly on the abnormal transfer and its response.

What the transaction record showed

The Ethereum transaction was confirmed at 04:06:41 UTC on November 27, corresponding to 1:06:41 p.m. Korea Standard Time. A single transfer moved exactly 342,000 ETH from an address identified by blockchain explorers as belonging to Upbit to 0xa09871AEadF4994Ca12f5c0b6056BBd1d343c029.

That on-chain record independently verifies the quantity, timestamp, sender and destination. It cannot, by itself, show whether the transaction was authorized, how signing authority was obtained or who controlled the destination. The conclusion that the ether was missing from Upbit rests on the exchange’s own incident notice and its commitment to absorb the loss.

Upbit valued the transfer at approximately 58 billion Korean won. Yonhap News Agency reported a contemporaneous conversion of about $49.3 million. A separate transaction monitor used an ETH reference price of $145.05 and produced a value close to $49.6 million. These figures were event-time estimates drawn from different price and foreign-exchange inputs, not proceeds realized by the recipient or a measured customer loss.

Upbit contained the operational damage

Dunamu chief executive Lee Seok-woo, speaking for the company that operated Upbit, said the exchange began responding immediately after detecting the transaction. Upbit transferred cryptocurrency remaining in its online hot-wallet environment into cold wallets, which keep signing credentials outside continuously connected transaction systems.

The company said customers would not bear the missing 342,000 ETH because Upbit would cover it with corporate assets. That was a contemporaneous commitment rather than an independently audited reimbursement result. Upbit also estimated that restoring deposit and withdrawal services would require at least two weeks.

The service suspension mattered separately from the balance-sheet promise. Customers could still face restricted access while the exchange inspected its wallet infrastructure, even if Upbit ultimately made account balances whole. The incident therefore exposed both solvency risk—the ability to replace missing assets—and operational risk—the ability to process transfers safely and continuously.

Why the event mattered beyond one exchange

Hot wallets were necessary for exchanges to process routine withdrawals without manually retrieving offline keys, but permanent network connectivity enlarged the systems and credentials exposed to attack. Upbit’s response illustrated the standard custody tradeoff: liquidity and automation made withdrawals faster, while cold storage reduced online exposure at the cost of additional operational steps.

The transfer also created potential market concerns because 342,000 ETH had moved into an unidentified address and could theoretically be divided or sent onward. The reviewed event-day evidence does not establish that the ether was sold, that it caused a particular ETH price move or that another venue accepted the funds. No broader return or trading-volume claim is therefore warranted.

What remained unknown on November 27

Upbit had not publicly disclosed a technical cause by the end of November 27, 2019. The available notice did not distinguish among compromised private keys, breached signing systems, deceptive authorization, insider activity or another mechanism. It also did not attribute the incident to any person, organization or state.

Claims about additional stolen assets were circulating, but Upbit said the large movements in other cryptocurrencies reflected its own transfer of funds into cold wallets and that only ether was lost. The defensible event-day record is consequently limited but clear: 342,000 ETH left Upbit’s hot wallet, the exchange treated the transfer as a loss, and customers’ ability to deposit or withdraw assets was suspended while the company secured its remaining holdings.