Upbit Resets All Deposit Addresses After Security Breach

• Upbit deletes all old deposit addresses during wallet maintenance.
• Exchange will resume deposits and withdrawals for 33 assets on December 5.
• Move follows November 27 security breach causing $30-37M in losses.

South Korea’s largest cryptocurrency exchange Upbit has deleted all old deposit addresses amid wallet maintenance. Users must generate new deposit addresses before making any deposits to the platform.

Upbit announced that deposits and withdrawals for 33 assets across 21 networks will gradually resume starting December 5 at 17:00 KST. The wallet maintenance update follows a November 27 security breach that caused approximately 44.5 billion KRW in losses.

The exchange stated that using existing deposit addresses may result in delays in deposits being reflected. Users must issue new deposit addresses before depositing digital assets to avoid processing delays.

South Korea’s largest crypto exchange Upbit has deleted all old deposit addresses amid wallet maintenance. Users must generate new ones before depositing. From Dec. 5 at 17:00 (KST), deposits and withdrawals for 33 assets across 21 networks will gradually resume. The update…

— Wu Blockchain (@WuBlockchain) December 5, 2025

Upbit deletes all existing deposit addresses

The exchange deleted all existing deposit addresses for digital assets during the wallet maintenance period. This affects every user on the platform regardless of account status or asset holdings.

Upbit stated the deletions stem from security vulnerability improvements and wallet system maintenance. The platform requires new deposit addresses for all digital assets following the system overhaul.

The exchange urged users to immediately delete any existing Upbit deposit addresses registered with personal wallets or other exchanges. This prevents future misuse of old addresses that no longer function on the platform.

33 assets resume deposits across 21 networks

Deposits and withdrawals will resume at 5:00 PM on December 5, 2025. The initial batch includes 33 digital assets operating across 21 different blockchain networks.

Networks included in the first resumption wave are AELF, Algorand, Astar Network, Filecoin, Flow, Hedera, Hive, IOST, IOTA, MultiversX, NEO N3, Nervos, Ontology, Polymesh, Stacks, Steem, Swellchain, Tezos, Vaulta, VeChain, and WAX.

Upbit will sequentially resume services for network digital assets whose wallet systems have been inspected and whose deposit and withdrawal security has been confirmed. This phased approach allows the exchange to verify security measures before expanding access.

The exchange noted that for Vaulta and WAX network digital asset deposit addresses, new addresses will be issued using the same system as before.

Digital assets paid through airdrops, for which trading support has ended, or for which a watchlist has been designated will only have withdrawals resumed. Deposits for these assets remain suspended.

November security breach prompted Upbit maintenance

On November 27, 2025, Upbit suffered a major security breach resulting in approximately $30-37 million in losses. The hack involved the theft of 44.5 billion Korean won worth of digital assets.

The stolen funds primarily consisted of Solana-based tokens including SOL, ORCA, RAY, JUP, BONK, and RENDER. Unauthorized withdrawals were detected at 4:42 AM KST when abnormal outflows from the exchange’s hot wallet were flagged.

Researchers discovered the breach happened through a flaw in Upbit’s digital signature algorithm. The vulnerability produced weak or predictable signing data. This flaw potentially allowed attackers to derive private keys from publicly accessible blockchain transaction history.

The wallet maintenance and address deletion is the exchange’s response to close this security vulnerability. The complete reset of deposit addresses prevents exploitation of the compromised signature system.

Lazarus Group suspected in Upbit attack

South Korean authorities suspect North Korea’s Lazarus Group was behind the attack. The timing is particularly notable as the breach occurred almost exactly six years after Upbit’s previous hack on November 27, 2019.

The 2019 hack saw 342,000 Ethereum worth $41.5 million stolen, also attributed to Lazarus Group. The November 27, 2025 attack coincided with the announcement of Naver’s $10.3 billion acquisition of Dunamu, which is Upbit’s parent company.

The exchange warned users about price differences that may occur during the suspension of deposits and withdrawals.