OAK — OnChain Attack Knowledge

Worked example · 2019-11

Upbit exchange hack — Ethereum — 2019-11-27

Loss
342,000 ETH, about $48.7M (58 billion won) at the time per Upbit's CEO, from South Korean exchange Upbit's Ethereum hot wallet, moved in one transfer to an unknown address [securityaffairs][theblock]. Reports give $41.5M to ~$50M for the 2019 value depending on the price used.
OAK Techniques observed
OAK-T11.001 (Third-Party Signing-Vendor UI / Signing-Flow Compromise — broadly construed; the access path was never published, so the exact mechanism is unverified). OAK-T7.001 (Mixer-Routed Laundering — per South Korean police, about 57% of the ETH was converted to bitcoin through three online exchanges and the rest sent to 51 overseas exchanges [theblock]).
OAK-Gnn
OAK-G01 Lazarus Group / DPRK-attributed.
Attribution
confirmed — on 2024-11-21 South Korea's National Police Agency said North Korean hackers were responsible, citing North Korean IP addresses, asset flows, North Korean terminology, and FBI cooperation [theblock]; Korean coverage names the Lazarus and Andariel groups [cointelegraphkr].
Key teaching point
Upbit's 342,000 ETH single-transfer hot-wallet drain was attributed to North Korea only five years later, by police evidence rather than on-chain clustering alone. It illustrates the long gap between an exchange hot-wallet theft and a formal state attribution.
Corrected 2026-10-11
Attribution source corrected to the National Police Agency statement of 2024-11-21 (not a "Cyber Bureau" or wallet-cluster vendors); laundering description replaced with police-reported figures; unsourced claims (audit, resumption dates, DPRK-pattern comparisons, Chainalysis/Elliptic/TRM and UN Panel citations) removed; 2019 value range noted.

Summary

Upbit, a South Korean exchange operated by Dunamu, reported that at 1:06 PM on 2019-11-27, 342,000 ETH was moved from its Ethereum hot wallet to an unknown address [securityaffairs]. Upbit's CEO valued it at about 58 billion won ($48.7M), said the exchange would cover user losses from its own assets, suspended deposits and withdrawals, and moved its crypto holdings to cold wallets [securityaffairs]. The exchange stopped short of calling the incident a "hack" in its first statements [securityaffairs].

On 2024-11-21 the National Police Agency announced that North Korea was the perpetrator, citing North Korean IP addresses, the flow of virtual assets and terminology, and long-term FBI cooperation; the statement called the victim only "A", which police confirmed to be Upbit [theblock]. About 57% of the ETH was converted to bitcoin at a 2.5% discount through three online exchanges that appear to have been attacker-created; the rest went to 51 overseas exchanges. Police working with Swiss authorities recovered 4.8 BTC and returned it to Upbit [theblock].

Timeline (UTC)

When Event OAK ref
2019-11-27 342,000 ETH moved from Upbit's Ethereum hot wallet to an unknown address (13:06 local time per Upbit) T11.001 (mechanism unpublished)
2019-11-27 Upbit suspends deposits/withdrawals, moves assets to cold wallets, says it will cover user losses (defender response)
2019-11 onward ETH converted to BTC via three exchanges and spread to 51 overseas exchanges (per 2024 police statement) T7.001
2024-11-21 National Police Agency attributes the theft to North Korea; 4.8 BTC returned to Upbit (attribution)

Realised extraction

342,000 ETH (~$48.7M at the time; over $1B at 2024 prices per The Block [theblock]). Only 4.8 BTC reported recovered [theblock]; Upbit covered user losses [securityaffairs].

Public references

Techniques demonstrated (2)