Upbit, Bithumb warn on SAND after cross-chain bridge hack

Upbit scheduled its initial SAND review period from Aug. 24 at 3 p.m. KST through the fifth week of September, running from Sept. 28 to Oct. 4. During that period, the exchange will review the reasons behind the caution designation under its digital asset trading support termination policy. Depending on the findings, Upbit can remove the warning, extend the review or decide to terminate trading support.

A security concern that has not been completely resolved can result in trading support being withdrawn, according to the exchange. Any extension or termination decision will be published separately with the applicable schedule.

SAND deposits made after the caution notice was published will not be credited to user accounts and will instead qualify for return processing. The token has also been removed from assets available for new borrowing applications under Upbit's coin lending service, although existing loans can remain active until their original maturity dates.

Upbit said SAND withdrawals will be the first transfer service restored when the current suspension ends. Deposits will not automatically reopen at the same time and will instead be handled under the procedure applicable to assets already designated for trading caution.

Bithumb is working on a slightly different review schedule. Its notice said a decision on extending or removing the designation, or ending trading support, is expected during the first week of October, specifically between Sept. 28 and Oct. 2. The schedule can change depending on the exchange's internal review. Bithumb also said the caution status can be removed before the review period ends if the underlying reasons are resolved.

The SAND action follows previous cases in which South Korean exchanges placed tokens under caution while assessing a project's response to a security breach. In July, Upbit removed its warning on Taiko after reviewing information supplied by the layer-2 project about a June bridge exploit and the security measures introduced afterward. Taiko had initially been placed under warning on June 22 after Upbit identified a security incident involving systems used to issue, transfer or store the asset. After a 32-day review, Upbit said the project had provided information covering the cause of the breach and subsequent security measures, allowing the exchange to determine that the reason for the warning had been resolved. Bithumb removed its Taiko warning on the same day.

Security incidents have also led to more severe outcomes when Korean exchanges were not satisfied with a project's remediation. Earlier this year, Flow Foundation and Dapper Labs sought a court order after Upbit, Bithumb and Coinone moved to end FLOW trading support following a December 2025 exploit. The Flow incident involved a protocol-level vulnerability that allowed an attacker to create duplicated tokens and extract about $3.9 million in value. Flow later said user balances were not affected, while validators and exchange partners took emergency measures to contain the incident and recover funds. Despite the later remediation work, the Korean exchanges moved toward delisting FLOW, prompting the foundation and Dapper Labs to ask the Seoul Central District Court to suspend the trading termination while additional evidence was reviewed.

Security incidents at South Korean trading platforms have also drawn attention from domestic regulators under the country's Virtual Asset User Protection Act. South Korea's Financial Supervisory Service began a formal sanctions process against Upbit operator Dunamu in July over a November 2025 wallet breach that affected Solana-based assets. The FSS action followed an inspection into whether the exchange had met its obligations under the user protection law. Korean reports cited in the July coverage put the affected amount at 44.5 billion won, while Upbit said after the incident that customer losses would be covered with company funds.

For broader context on how crypto market analysis treats exchange-driven delisting risks, the SAND case fits a pattern where Korean platforms demand clear remediation before restoring full service. The token's fate now depends on whether The Sandbox can satisfy both exchanges before their respective review deadlines.