Upbit’s Delayed Hack Disclosure Raises Regulatory Concerns

South Korea’s largest virtual asset exchange, Upbit, is facing criticism for its Upbit delayed hack disclosure, which amounted to a delay of 7 hours and 51 minutes and raised concerns about the adequacy of its response. This response has been contrasted with Bybit—currently the world’s second-largest exchange—which publicly addressed its own hacking incident within approximately 90 minutes through direct communication from its co-founder and CEO, prompting concerns that Upbit’s crisis management fell short of international standards.

Upbit confirmed on November 27 that approximately 100 billion coins had been illicitly transferred, yet notifications to regulatory agencies and public disclosure were made only after significant delays. The Upbit delayed hack disclosure has also raised questions about the exchange’s external communication practices, as senior executives of Dunamu, Upbit’s operating company, participated in a scheduled press briefing the same day without mentioning the incident. The case further highlights gaps in the current self-regulatory framework for digital asset exchanges, as DAXA acknowledged that no rules presently govern the timing of exchange-level disclosures.

Regarding the incident, Attorney Ohoon Kwon of Cha & Kwon Law Offices stated, “While the formal reporting obligations were met, it is questionable whether the delayed notification aligns with the purpose of prompt reporting. Given that current law contains no direct sanction provisions for hacking incidents involving virtual asset service providers, there is a need for legislation that clearly stipulates IT security obligations and liability for damages in the event of such incidents.”

Overall, the Upbit delayed hack disclosure underscores the broader need to strengthen statutory disclosure requirements and clarify the responsibilities of digital asset exchanges in responding to security breaches.