Upbit
Hacked twice, six years apart, both times on 27 November — and the only exchange we rate where "users were made whole" is independently confirmed.
- Founded
- 2017
- Registered
- South Korea
- Site
- upbit.com
The short answer
It is the only venue in our rating where reimbursement is confirmed rather than promised, and it has been confirmed twice: after 342,000 ETH went in 2019 and roughly $36m of Solana assets in November 2025, both attributed to North Korean actors. Both happened on 27 November, six years apart. A named firm attests assets and liabilities semi-annually, most recently showing 103.19% coverage at 31 December 2025. It is thin — 7.3 BTC of depth — and its API took 2.4 seconds.
Key facts
| Two hacks, same date | 342,000 ETH in 2019 and roughly $36m of Solana assets in November 2025, both attributed to North Korean actors — and both on 27 November, six years apartas of 14 Jul 2026 |
|---|---|
| Reimbursement | Independently confirmed both times. The only venue in our rating where that can be said.as of 14 Jul 2026 |
| Reserve reporting | A named third-party firm publishes a report every six months covering company holdings against user-entrusted balances, reconciled to the user registry. The 31 December 2025 report showed 103.19% coverage.as of 14 Jul 2026 |
| What it lacks | No Merkle tree to self-verify, and no ring-fenced fund — you are relying on the company staying solventas of 14 Jul 2026 |
| Custody score | 8 out of 10as of 14 Jul 2026 |
| Effective cost, $10,000 BTC buy (measured by us) | 0.05% — flat at every size we tested, including $100,000as of 14 Jul 2026 |
| Order-book depth within 0.1% (measured by us) | 7.3 BTC — the thinnest of any venue we pricedas of 14 Jul 2026 |
| API response latency (measured by us) | 2,390 msas of 14 Jul 2026 |
The only exchange where "users were made whole" is verified
Across this entire rating, one venue has had its reimbursement independently confirmed rather than merely pledged, and it has happened twice. Upbit lost 342,000 ETH in 2019 and roughly $36m of Solana assets in November 2025, both attributed to North Korean actors, and both times users were made whole with outside confirmation.
Set that against the rest of the category. KuCoin’s $281m, HTX’s $100m-plus, Poloniex’s $120m, BingX’s $43–52m — every one produced a compensation pledge, and not one has been independently verified. Phemex’s incident timeline never mentions the subject. The gap between saying and being checked is the single most useful distinction in this category, and Upbit is on the right side of it twice over.
A coincidence worth noting, because it is genuinely strange: both hacks happened on 27 November, six years apart.
Its reserve reporting is unusual in form and strong in substance. A named third-party firm publishes a report every six months covering both sides — company holdings against user-entrusted balances, reconciled to the user registry — and the 31 December 2025 report showed 103.19% coverage. Reconciling to the registry is a stronger exercise than a Merkle snapshot in one respect: it checks the liability list itself rather than accepting it.
What it does not offer is a Merkle tree you can verify yourself, or a ring-fenced fund. You are relying on a company that has twice proved it pays, which is evidence and not a structure. We score custody 8 out of 10.
Cheapest flat pricing, thinnest book
A bitcoin buy cost 0.05% at every size we tested — $1,000, $10,000 and $100,000 alike. That is the flattest and among the cheapest pricing in the rating, and it comes with the biggest caveat in it.
Depth measured 7.3 BTC within 0.1% of best ask, the thinnest of any venue we priced — a twenty-sixth of Kraken’s. The flat cost curve reflects the fee schedule rather than a deep book, and anyone moving real size will find the price impact where the fee is not.
API response latency measured 2,390 ms, third slowest in the run.
Fiat scores 3 out of 10 and liquidity 3 out of 10, which is what keeps a venue with genuinely excellent custody evidence at mid-table. Upbit is overwhelmingly a Korean-market exchange, and its strengths and weaknesses both follow from that.
Incident record
| Date | Type | Amount | Were users made whole? |
|---|---|---|---|
| 27 Nov 2025 | Hack or exploit | $36,000,000 | Yes, independently confirmed. Roughly $36m of Solana assets, attributed to North Korean actors.$36,000,000 returnedsource |
| 27 Nov 2019 | Hack or exploit | — | Yes, independently confirmed. 342,000 ETH, attributed to North Korean actors — six years to the day before the second incident.source |
In our ratings
Compared with
Our coverage of Upbit
- How to spot a fake proof of reserves27 Sept 2026
- Bitget loses $351.6m — and the fund it says covers it is one we could not verify25 Sept 2026
- Is Kraken safe? The evidence, and what it lacks25 Sept 2026
- What happens to your coins if an exchange goes bankrupt23 Sept 2026
- Is Coinbase safe? What its own filings say19 Sept 2026
- How to move crypto off an exchange, step by step17 Sept 2026
- Token approvals: the permission that drains wallets15 Sept 2026
- What "not your keys, not your coins" leaves out9 Sept 2026
- The seed phrase mistakes that cost people everything7 Sept 2026
- Hardware wallet or software wallet: how to decide5 Sept 2026
Questions people ask
Is Upbit safe?
It has the second-highest custody score in our rating at 8 out of 10, and the best track record on the question that matters: it is the only venue where reimbursement after a hack has been independently confirmed rather than pledged, and it has happened twice.
How many times has Upbit been hacked?
Twice — 342,000 ETH in 2019 and roughly $36m of Solana assets in November 2025, both attributed to North Korean actors. Both occurred on 27 November, six years apart. Users were made whole both times, independently confirmed.
Does Upbit publish proof of reserves?
Not as a Merkle tree you can self-verify. A named third-party firm publishes a semi-annual report covering company holdings against user-entrusted balances, reconciled to the user registry — the 31 December 2025 report showed 103.19% coverage. Reconciling to the registry checks the liability list rather than accepting it.
Is Upbit liquid?
No. We measured 7.3 BTC of depth within 0.1% of best ask, the thinnest of any venue we priced. Its flat 0.05% pricing at every size reflects the fee schedule, not the book, and larger orders will find the impact elsewhere.
What changed
- 27 Sept 2026 — Profile published.