South Korea's financial regulator has initiated a formal sanctions process against Dunamu, the parent company operating Upbit, the country's largest cryptocurrency exchange. The move follows a $36 million security breach that has drawn scrutiny under the nation's Virtual Asset User Protection Act, though the legislation's ambiguity on hacking penalties creates uncertainty around potential consequences for the company and its workforce. The sanctions process comes as South Korean authorities navigate enforcement challenges within the country's relatively new crypto regulatory framework.
South Korea's National Police Agency has awarded Dunamu a one-year contract worth ₹195,000 to custody seized cryptocurrencies through Upbit Custody after a competitive bidding process. According to a statement released by Dunamu on August 7, the company was named the final winner of the Korean National Police Agency's project to store and manage confiscated digital assets following technical negotiations that concluded the procurement process. The contract was awarded through an open competitive tender administered by South Korea's Public Procurement Service, with Dunamu receiving the highest technical evaluation score of 94.14 before being selected as the final contractor.
Under the agreement, seized cryptocurrencies will be stored and managed through Upbit Custody, Dunamu's digital asset custody service. The platform operates within a 24-hour, 365-day monitoring system that continues running during nights, weekends, and public holidays so custody operations remain uninterrupted. The custody platform uses a security environment built around 100% offline cold wallets that remain isolated from the public internet. According to Dunamu, its infrastructure incorporates Multi-Party Computation (MPC), Distributed Key Generation (DKG), multi-signature technology and wallet segregation, allowing assets to be separated according to their type and intended use while reducing the risks associated with a single compromised private key.
The regulatory scrutiny of Upbit comes at a critical time as South Korean authorities navigate enforcement challenges within the country's relatively new crypto regulatory framework. The Virtual Asset User Protection Act currently lacks explicit provisions for sanctioning exchanges following security incidents, leaving regulators to interpret existing rules when addressing hacking-related violations. This regulatory gray area presents complications for both the company and the broader Korean crypto sector, with the uncertain penalty structure making it difficult to assess potential operational impacts, including possible staffing adjustments or compliance-related hiring needs.
Industry participants questioned whether the tender requirements favored larger market operators, with bidders required to accept immediate custody of seized cryptocurrencies, maintain a round-the-clock response system and guarantee full compensation if assets were lost through hacking. Several custody industry officials told local media that those requirements were easier for a large exchange operator with established infrastructure to satisfy than for standalone custody providers. However, the National Police Agency rejected suggestions that the outcome had been predetermined, stating the contractor had been selected through a fair competitive process. The outcome of Dunamu's case will likely establish important precedents for how Korean authorities handle future security incidents at registered exchanges, potentially accelerating demand for specialized roles in legal, compliance, and security teams across the Korean crypto sector.
