Upbit Operator Dunamu Faces FSS Sanctions Over $32M Hack

South Korea's Virtual Asset User Protection Act has no specific penalty provisions for cyber breaches or system failures. That gap creates uncertainty about the FSS's enforcement range. The regulator will evaluate Dunamu's official response before issuing any preliminary sanction notice. Final measures would need review by the sanctions review committee, the Securities and Futures Commission, and the Financial Services Commission.

Government officials have said they plan to address hacking provisions and compensation rules in the second phase of the Digital Asset Basic Act.

This marks the second regulatory action against Dunamu. The Financial Intelligence Unit previously fined the company 35.2 billion won for anti-money laundering and customer verification shortfalls. Courts later overturned part of that penalty, citing an insufficient legal basis.

Dunamu is also working on a share exchange with Naver Financial. The deal has been pushed back to Dec. 31, pending regulatory approvals. The sanctions proceedings do not automatically block the transaction. They add another layer of regulatory scrutiny.

The FSS has not disclosed a specific sanction amount. Dunamu can contest the inspection conclusions through the remaining review process.