It seems to be a breach of permissions at the hot wallet level, allowing the selection of which coins to transfer first, controlling the transfer pace, and completing major actions before risk control is triggered.
Why is it almost entirely BONK? BONK has a large enough volume but is not sensitive to single selling pressure, making it easy to slowly unload in cross-routing without triggering market-wide alert by crashing the price all at once. The hacker understands the liquidity structure of $SOL .
In general, when faced with such a situation, exchanges have two choices. Either stabilize emotions and handle it internally, or acknowledge the loss of control and engage externally at the first opportunity. It is clear that this time Upbit chose the former.
This does not mean Upbit is unsafe, but when a platform is large enough to absorb a loss of 240 million RMB with its own funds while maintaining silence during the most critical 6 hours, you should realize that the risk you are assuming is far beyond what you think it is.
