South Korea's largest cryptocurrency exchange Upbit announced plans to raise the share of cold wallet storage to 99 percent after a major security breach last month.
The announcement relates to a comprehensive cybersecurity overhaul of the exchange that began when hackers managed to steal about 44.5 billion won (31 million dollars) of Solana-based assets on November 27.
Upbit reinforces security following another data breach on November 27.
According to operator Dunamu, Upbit held 98.33 percent of customer digital assets in cold wallets at the end of October, while only 1.67 percent was in hot wallets. The exchange has announced that it has renewed its entire wallet infrastructure and aims to reduce the funds in hot wallets to below one percent in the coming months. Dunamu emphasized that protecting customer funds is Upbit's top priority, and all losses related to the data breach were covered by the company's own reserves.
The data breach was Upbit's second largest hacking incident, occurring exactly on the same date six years earlier. In 2019, North Korean hacking groups Lazarus and Andariel stole 342,000 ETH from a hot wallet. This time, attackers emptied 24 different Solana network tokens in just 54 minutes in the early hours.
According to South Korea's virtual asset user protection law, exchanges must keep at least 80 percent of customer funds in cold wallets. Upbit clearly exceeds this threshold and maintains the smallest hot wallet share among domestic exchanges. According to data published by representative Huh Young, other Korean exchanges maintained a cold wallet share of 82–90 percent in June.
Upbit exceeds international industry standards
Upbit's security metrics are comparable to major international exchanges. Coinbase keeps about 98 percent of customer funds in cold storage, and Kraken holds 95–97 percent of its assets offline. OKX, Gate.io, and MEXC each keep about 95 percent of their assets in cold wallets. Binance and Bybit have not released exact shares but emphasize that most of their assets are offline.
International exchanges have recently highlighted Proof of Reserves audits to demonstrate their solvency, while Korean regulators require direct reporting of the ratio of cold to hot wallets. Upbit's goal of keeping the hot wallet share below one percent would raise industry standards to a new level globally.
Liquidity concerns in isolated markets
However, some analysts have raised concerns about potential conflicts between security and liquidity. South Korea's strict regulations on the crypto market require real names on bank accounts and restrict foreign participation. This closed structure maintains the so-called “Kimchi premium,” where local prices often diverge from international ones due to limited arbitrage opportunities.
When the funds in hot wallets are very small, withdrawals can be delayed during strong market fluctuations. As investors seek to transfer funds abroad to take advantage of price discrepancies, a slower withdrawal process can exacerbate market efficiency issues.
For example, when Upbit suspended withdrawals after the hacking last month, arbitrage channels between Korean and international markets were effectively closed. As there was no mechanism for price correction, several altcoins surged instantly by double or even triple digits as trapped liquidity increased volatility.
According to Upbit, optimized systems and proactive modeling ensure sufficient liquidity under normal conditions. The exchange argues that protecting customer funds from security breaches is more important than occasional processing delays in exceptional market conditions.
