South Korean authorities and investigative agencies have formally identified North Korea's state-sponsored cyber-espionage organization, the Lazarus Group, as the perpetrator behind the significant security breach at Upbit, South Korea's largest cryptocurrency exchange. The attack resulted in the theft of substantial assets, primarily affecting the exchange's hot wallet infrastructure. Initial investigations pointed towards key management failures as the primary vector for the breach. Upbit CEO Song Chi-hyung (also referred to as Lee Sirgoo in some reports) has issued a formal apology regarding the incident, confirming that approximately 44.5 billion KRW (roughly $32 million) was stolen. He admitted to internal lapses in security protocols and pledged that the exchange would fully compensate affected users using corporate funds. The breach specifically targeted a Solana hot wallet, exploiting a vulnerability in private key management. [Update 1] New reports provide further technical insight into the breach. CryptoQuant CEO Ki Young Ju has analyzed the incident, suggesting that the sophistication of the attack—specifically the method used to deduce private keys—aligns with the capabilities of the North Korean Lazarus Group. In response to the breach, Upbit has suspended certain services to overhaul its wallet system and reinforce its security infrastructure against future threats.