Upbit review.

Overview

Upbit is South Korea’s largest digital asset exchange, run by Dunamu Inc. (두나무 주식회사) from 15F, 369 Gangnam-daero, Seocho-gu, Seoul. The exchange opened in 2017, its site footer carries a copyright range of 2017 to 2026, and on 13 August 2026 its public market API listed 831 tradable markets across 351 distinct assets. It is the reference venue for Korean won crypto trading, and for most of its users it is the only exchange they have ever used.

Two facts shape everything else in this review, and both cut against the way an exchange of this size is usually described. The first is what Upbit’s registration actually is: an anti money laundering reporting acceptance from the Korea Financial Intelligence Unit, not an authorisation to hold client assets, because Korean law creates no such authorisation for anyone. What the reader is told to look for does not exist, and what does the protecting is a separate statute. Licences & Custody takes that apart properly. The second is who can actually open an account: signing up needs a phone in your own name on a Korean carrier and a Korean bank account, and moving won needs a K Bank account specifically, so somebody reading this from London or Jakarta cannot open a Korean Upbit account at all.

Upbit has also been robbed twice. In November 2019 roughly 342,000 ETH left its Ethereum hot wallet. In November 2025, six years to the day, a second hot wallet breach took Solana network assets. Both are documented below with dates, amounts and the firm’s own words, and both were covered from company assets. The second one matters most, because Upbit’s own explanation of it is that private keys could be inferred from public on chain transactions.

Overview Table

Facts List

• Operator: Dunamu Inc., business registration number 119-86-54968, CEO Oh Kyoung-suk (오경석).
• KoFIU report accepted 6 October 2021; renewal acceptance issued 23 December 2025.
• The KoFIU register records Dunamu for categories (c) (다), (d) (라) and (e) (마) only: transfer, custody and brokerage. It does not record (a) (가) (dealing on own account) or (b) (나) (asset for asset exchange).
• Real name verified deposit and withdrawal account: K Bank (케이뱅크), and no other bank.
• KRW market trading fee 0.05% maker and taker on ordinary orders, 0.139% on reserved orders. BTC and USDT markets 0.25%.
• KRW withdrawal fee 1,000 KRW flat; KRW deposits free; minimum KRW deposit 5,000 and minimum KRW withdrawal 1.
• Deposit usage fee paid on idle won balances at 2.1% a year before tax, to Korean resident members with valid customer verification.
• Reserves tested quarterly by an external accounting firm under agreed upon procedures since 28 June 2018, not an audit; as at 1 July 2026, 103.27% of digital assets and 118.29% of money payable to members. A self published daily reconciliation covers 351 assets between quarters.
• ISMS-P certified, number ISMS-P-KISA-2021-027, scoped to “virtual asset exchange and wallet service operation (Upbit) (가상자산 거래소 및 지갑 서비스 운영(업비트))“, valid 1 September 2024 to 31 August 2027.
• Dunamu is subject to a board resolved share exchange that would make Naver Financial its 100% parent, with completion currently set for 31 December 2026.

Key Takeaways

• An AML reporting acceptance is not a licence to hold your coins. KoFIU accepted Dunamu’s report on 6 October 2021 and its renewal on 23 December 2025. That is anti money laundering supervision. Korea issues no authorisation to custody client crypto, so there is nothing stronger to hold.
• The custody duties are real and they come from a different statute. The Virtual Asset User Protection Act requires 100% of user won deposits to sit at a bank separate from the firm’s own money, at least 80% of user crypto by economic value to be held offline, and insurance or a reserve of at least the greater of 5% of hot wallet value and 3 billion KRW.
• Reserves are evidenced twice over, which is better than most, though neither exercise is an audit. A BDO member firm has run agreed upon procedures over holdings against amounts payable to members every quarter since June 2018, expressing no assurance but including a test where the accountant picks a wallet and Upbit must prove control of it; the 1 July 2026 report puts digital assets at 103.27% and money at 118.29%, and names the five assets that fell short with causes. Between quarters Upbit self publishes a daily reconciliation, 351 assets on 12 August 2026, none below 100%.
• The English contract is missing the clause that matters most. Article 9 of the Korean terms carries the deposit segregation undertaking. Article 9 of the English terms, at the same nine paragraphs and the same effective date, does not: paragraph 7 is a membership administration rule instead. The English text also states the Korean version prevails.
• Two hot wallet thefts, six years apart to the day. 342,000 ETH in November 2019, and roughly 44.5 billion KRW of Solana network assets in November 2025. Upbit covered both from company assets. Its own explanation of the 2025 breach is that private keys could be inferred from public on chain transactions.
• The enforcement record is live, not settled. KoFIU imposed a fine of 35,215,600,000 KRW on 9 December 2025; Dunamu formally objected on 6 February 2026, which under the Act on Regulation of Violations of Public Order makes the imposition lose effect and sends it to a court fine proceeding, so it is neither final nor paid. A three month partial suspension ordered in February 2025 was stayed in March 2025, cancelled by the Seoul Administrative Court in April 2026, and appealed by KoFIU later that month.
• The criminal case against Dunamu executives ended in acquittal at every instance. First instance 31 January 2020, appeal 7 December 2022, and the Supreme Court dismissed the prosecution’s appeal on 9 November 2023. It is final.
• You almost certainly cannot open a Korean account. Signing up needs a Korean carrier phone in your own name and a Korean bank account, and won movement needs a K Bank real name account. Non-residents, foreign companies and under 19s can be refused outright.
• Cheap in won, ordinary elsewhere. 0.05% each side on KRW pairs is at the low end of anything, but reserved orders cost 0.139% and the BTC and USDT books charge 0.25%. In March 2026 the Korea Fair Trade Commission ordered Upbit to correct advertising that presented a cut from 0.139% to 0.05%, on the ground that 0.139% had never been applied.
• Suited to a Korean resident who wants deep won liquidity and a lot of listings. Not usable by anyone outside Korea, and not a place to hold assets on the assumption that a regulator stands behind the custody.

Licences & Custody

Upbit is regulated, and it is important to be exact about what by. Korea runs two instruments over the same firm and they do different jobs. Recording the first as though it were the second is the single most common way a crypto exchange is described as safer than the law makes it.

The Specific Financial Information Act requires a Virtual Asset Service Provider to report to the Korea Financial Intelligence Unit (KoFIU, 금융정보분석원), a unit inside the Financial Services Commission. KoFIU may refuse a report on listed grounds, and accepted reports lapse after three years unless renewed. That regime is AML supervision plus specific operational duties, most importantly the real name verified bank account. It does not authorise anybody to hold client assets.

The Virtual Asset User Protection Act, in force 19 July 2024, is where the custody duties live. It creates no licence and no register, so there is nothing to look up. It simply binds anyone who is a VASP.

Dunamu’s entry on KoFIU’s published list records a report filed 20 August 2021, an acceptance certificate issued 6 October 2021, and a renewal acceptance certificate issued 23 December 2025. Two changes to the real name account arrangement were filed, on 4 October 2024 and 2 October 2025. There is no compulsory cancellation recorded.

Two details on that record are worth reading closely. First, KoFIU’s list publishes no registration number at all; the only number against Dunamu is its business registration number 119-86-54968. Upbit’s own site footer shows “virtual asset business operator registration number 2021-01 (가상자산사업자 등록번호 2021-01)”, and that string does not appear on the register. Treat it as a label the firm applies to itself, not as a number you can check. Second, the register records Dunamu for categories (c) (다), (d) (라) and (e) (마), meaning transfer of virtual assets, custody and management, and brokerage of trading and exchange. It does not record (a) (가), dealing on own account, or (b) (나), asset for asset exchange. Several other Korean exchanges are recorded for (a) through (e). On the face of the register, Upbit is registered as an intermediary and custodian rather than a principal dealer, which is a meaningful thing for a user to know about who is on the other side of their order.

Licence Table

All five rows were checked against the authority’s own record. Searches of the ESMA interim MiCA registers returned nothing for Dunamu or Upbit across the CASP, non compliant and other files, with Bitpanda and Coinbase confirming those files were readable. The FCA register returned no authorisation and no clone or unauthorised firm warning under either name, with a Coinbase control returning seven records.

Which Entity You Contract With, By Residence

“Upbit” is four companies. The one you deal with is decided by where you live, and they are not equivalent. The Korean exchange is the large one; the Singapore book is a fraction of its size.

The Indonesian mismatch is worth stating plainly because it is the kind of thing a reader would reasonably misread. The OJK licence is real and current. The number printed under the OJK claim on the Indonesian homepage belongs to a different registration series from a different ministry, dated 2019, and it matches no record on that ministry’s live register either. The licence is fine; the number on the page is neither the licence nor a currently traceable registration.

Thailand’s regulator also carries six investor alerts against sites and apps impersonating Upbit Exchange (Thailand), including upbitbest.com, upbitbigglobalexchange.com, upbitexchange.com, upbitglobalexchange.com and apps called “Upbit Deal” and “Upbit Global Block”. Each is flagged as not licensed or supervised. Those are warnings about impersonators, not about Upbit, and they are the single most likely way somebody searching for this brand loses money.

What the Virtual Asset User Protection Act Actually Requires

These are the duties, taken from the Act, its Enforcement Decree and the FSC’s Virtual Asset Business Supervisory Regulation, rather than from anybody’s summary of them.

What Upbit Evidences, and What It Does Not

On the evidenced side: the deposit usage fee is real and quantified, at 2.1% a year before tax, aggregated on the daily closing won balance since 19 July 2024, paid net of 15.4% withholding, and Upbit’s own notice quotes Article 5 of the Supervisory Regulation as the basis. Reserves are tested quarterly by an outside accounting firm under agreed upon procedures, and reconciled daily by Upbit itself, both covered in Proof of Reserves. It holds ISMS-P certification, number ISMS-P-KISA-2021-027, scoped to “virtual asset exchange and wallet service operation (Upbit) (가상자산 거래소 및 지갑 서비스 운영(업비트))” and valid from 1 September 2024 to 31 August 2027, alongside ISO/IEC 27001, 27017, 27018, 27701 and ISO 22301.

On the not evidenced side, and these are gaps a careful reader should hold onto:

• Which bank holds the segregated deposits is not published. K Bank is the real name account bank, which is a different function under a different statute. Searches of Upbit’s terms in both languages, its help centre and its disclosure listing found no statement of the Virtual Asset User Protection Act managing institution.
• The insurance or reserve amount, and the insurer, are not published. The Act requires the measure and monthly recomputation; it does not require public disclosure of the amount. The absence is therefore compliant, and it also means the figure cannot be checked.
• The cold storage ratio is disclosed, but in a newsroom item rather than as a periodic filing. An article published on 10 December 2025 states that as at the end of October 2025 Upbit’s hot wallet held 1.67% of customer digital assets and its cold wallets 98.33%, names the statutory 80% floor, and says Upbit plans to push the hot wallet share below 1%. It cites data released by a member of the National Assembly putting other Korean exchanges at 82% to 90% cold as at the end of June against Upbit’s 98.3%. That is a dated, measured figure comfortably above the floor. It is self published, it is not on a fixed cycle, and the 99% in the headline is a stated target rather than the measurement.

The Korean and English Contracts Do Not Say the Same Thing

Upbit serves its terms as two static documents, terms_of_use.md and terms_of_use_en.md, both effective 1 January 2026 and both carrying 26 articles with matching paragraph counts throughout. Article 9, Company’s Obligations, has nine numbered paragraphs in each. Eight of the nine correspond. Paragraph 7 does not.

The Korean paragraph 7 is the deposit segregation undertaking:

회사는 회원의 예치금(회원으로부터 디지털자산의 매매, 매매의 중개, 그 밖의 영업행위와 관련하여 예치받은 금전, 이하 같음)을 고유재산과 분리하여 「은행법」에 따른 은행 등 가상자산이용자보호법 시행령으로 정하는 공신력 있는 기관에 가상자산이용자보호법 및 동법 시행령이 정하는 방법에 따라 예치 또는 신탁하여 관리합니다.

That is the firm promising to hold user deposits separately from its own property, at a bank under the Banking Act, in the manner the Virtual Asset User Protection Act prescribes. The English paragraph 7 in the same position is the 24 hour re-enrolment restriction, a membership administration rule that in the Korean text sits in Article 5. Searching the whole English document returns zero occurrences of “Banking Act”, “segregat”, “own assets”, “proprietary” or “separate from”, while “deposit usage fee” returns seven, “non-resident” four and “Virtual Asset User Protection Act” ten, so the search was working and the absence is real.

The English text closes with the standard note that it is a translation and that the Korean version prevails on any conflict. Legally, then, the Korean promise binds. Practically, an English reading reader is handed an obligations article with the custody promise taken out of it, and is unlikely to know that.

Enforcement Status, Read Correctly

Dunamu has a substantial regulatory and legal record, set out row by row with dates in the incident table in Deposits & Withdrawals. What belongs here is only its status, because that is what a reader needs before deciding whether the firm is under a cloud, and it is the part most often got wrong in both directions.

• The 35,215,600,000 KRW KoFIU fine is imposed but not final. It was imposed on 9 December 2025 and Dunamu formally objected on 6 February 2026 under the Act on Regulation of Violations of Public Order. Under that Act an objection makes the imposition lose its effect outright and refers the matter to a court fine proceeding. It has not been paid and no court has ruled on it.
• The three month partial suspension never operated and has been cancelled, but the case is open. Ordered 25 February 2025, stayed 26 March 2025, cancelled by the Seoul Administrative Court on 9 April 2026, appealed by KoFIU on 30 April 2026.
• The criminal case is finished, and Dunamu won it. Acquittal at first instance on 31 January 2020, upheld on appeal on 7 December 2022 in case 2020노367, and the Supreme Court dismissed the prosecution’s appeal in full on 9 November 2023 in 2022도16718.
• An earlier KoFIU fine was paid and closed. 80.7 million KRW on 27 February 2023, for suspicious transaction reporting and monitoring rather than customer verification. Not contested. It appears only in Dunamu’s own regulatory filing, because KoFIU’s sanction disclosure board begins in September 2023 and structurally cannot carry it.
• The regulator did not treat any of this as disqualifying. KoFIU accepted the renewal report on 23 December 2025, fourteen days after imposing the fine.
• Nothing was found against Upbit on personal data. A search of the Personal Information Protection Commission’s releases returned no action against Dunamu or Upbit, with a control search confirming that the commission does name and fine Korean crypto firms.

Trading & Execution

Upbit is a spot central limit order book. There are no perpetuals, no futures and no margin trading in the derivatives sense. Three books run side by side: a KRW book of 283 pairs, a BTC book of 322 and a USDT book of 226, for 831 markets in total on 13 August 2026. Orders match on the venue’s own engine and settle inside Upbit’s ledger; nothing touches a blockchain until you withdraw.

Order handling is the conventional set. A limit order rests on the book. A market order takes what is there. There is a reserved order type (예약주문), a conditional order that submits when a trigger price is reached, and it is priced differently from an ordinary order, which is covered in Accounts & Fee Tiers. Maker and taker are defined on Upbit’s own fee page: a maker adds resting size that does not fill immediately, a taker fills against resting size. The fee is charged on the executed value, quantity multiplied by price, and Upbit’s own worked example is that buying 1 BTC at 10,000,000 KRW at 0.139% debits 10,013,900 KRW.

Does the Venue Trade Against Its Users

This is the question that decides whether an order book is a market or a counterparty, and Korea gives an unusually checkable answer. The KoFIU register records Dunamu for categories (c) (다), (d) (라) and (e) (마): transfer, custody and brokerage of trading and exchange. It does not record category (a) (가), dealing on own account. Several peer exchanges are recorded for (a) through (e). So on the register Upbit is an intermediary, not a principal dealer.

The Virtual Asset User Protection Act separately bans a VASP from trading in coins issued by itself or its related parties, and requires continuous surveillance of abnormal trading with notification to the authorities. Upbit’s disclosure medium carries advance disclosures where other VASPs sell their own holdings, which is the mechanism the same rulebook uses to stop a venue front running its own sales.

The Market Alert System

Every market carries live flags in Upbit’s public API. On 13 August 2026, of 831 markets, 15 sat under a warning designation (유의 종목) and 211 carried at least one caution flag. The caution categories are published and specific: global price differences (171 markets), trading volume soaring (21), deposit amount soaring (21) and price fluctuations (9). A separate market alert page logs every alert with its level, its type, and the exact minute it was raised and cleared. In the 24 hours to 10:00 on 13 August 2026 it recorded 143 alerts. In January 2026 Upbit split the caution designation into three grades, caution (주의), warning (경고) and danger (위험).

The 171 markets flagged for global price differences are the interesting number. That flag exists because Korean won prices detach from international prices when capital cannot move freely, and it is a standing feature of this market rather than an anomaly. A trader buying a thinly traded altcoin on the KRW book is often paying a premium that cannot be arbitraged away.

Liquidation and Forced Repayment

Upbit has no margin trading, but it does have Coin Lending (코인빌리기), and that product has a liquidation engine with numbers a borrower has to know. The mechanics are set out on the product page and in its own terms.

• You post collateral in KRW, BTC, ETH or USDT, from 20,000 KRW, with a haircut by asset: KRW valued at 100%, stablecoins at 95%, everything else at 90%.
• You may borrow from 10,000 KRW up to 85% of collateral value, subject to a level based cap of up to 1 billion KRW. You cannot post the same asset you are borrowing.
• Where accumulated collateral reaches 100 million KRW, a formal pledge contract is executed over it.
• The usage fee is 0.05% of the borrowed quantity per day. Forced repayment costs 1% of the borrowed quantity, and collateral repayment the same, with a 0.05% trading fee on each of the sell and buy legs.
• Forced repayment triggers at a lending ratio of 95%, meaning borrowed value divided by collateral value, or at the expiry of the maximum 30 day term. The ratio is judged on an exponential moving average price to blunt momentary spikes. Warnings go out at 88%, 90% and 92% by KakaoTalk, email and push.
• Forced repayment also fires on non price grounds: attachment or seizure of the account, an investigative agency’s freeze request, a confiscation order, account sanctions including incomplete customer verification, confirmed death of the member, or delisting of either the borrowed or the collateral asset.
• There is no negative balance protection. The terms are explicit: if prices move sharply, a loss exceeding the collateral value can remain after the collateral is disposed of, and the company may claim the shortfall from the member. Upbit may also set that shortfall off against holdings of the same asset elsewhere in the account.

Under market alert conditions or a trading halt, Upbit may settle by deducting the collateral directly rather than selling it, at the real time price at the moment of deduction. In a fast market that is the difference between a fill you can reconstruct and a valuation you are handed.

When Trading and Transfers Can Be Suspended

The terms enumerate when deposits or withdrawals can stop, and the list is broader than a reader might expect: a fault in the virtual asset information system or the network that carries it, a fault at the financial institution holding the real name accounts, a fault at the counterparty’s venue, the delisting process for an asset, and the firm performing a reconciliation of what it actually holds against what users have entrusted. Article 20 then limits liability where the company proves it exercised the required managerial care, and the enumerated grounds include failures of the trading system and of the deposit and withdrawal system themselves. That is a real limitation and it should be read before it is needed rather than after.

Disputes are governed by Korean law and heard in the Korean courts. There is no arbitration clause and no foreign forum.

Accounts & Fee Tiers

Upbit has one account, not a menu. What varies is how far through verification you are, and that decides your limits rather than your pricing. There is a separate corporate membership route, and its signup flow states that a sole trader cannot join as a corporate member.

Trading Fees

There is no volume ladder. A first day retail user and a large desk pay the same, which is unusual and, for a small account, an advantage. The KRW rate of 0.05% each side is at the cheap end of anything available anywhere. The BTC and USDT books at 0.25% are not: that is five times the won rate and above what most international venues charge for equivalent flow.

The 0.139% reserved order rate deserves attention because it is nearly triple the ordinary rate for what is, to a user, the same trade with a trigger attached. Anyone who habitually works with stop or conditional orders on the KRW book is paying a materially different fee from the headline.

Upbit states that VAT is included in the trading fee, and that fees can change for promotional events, with the applicable rate fixed at the moment the order is submitted. At the time of writing a fee free event was running on the KRW pairs for USDT, USDC, USDE, USDS, USD1, RLUSD and USDG.

One thing to know about how this fee has been advertised. On 25 March 2026 the Korea Fair Trade Commission issued a corrective order against Upbit over advertising that presented a reduction from 0.139% to 0.05%. The Commission’s finding was that Upbit had never applied a 0.139% rate in the manner advertised, making the presentation false or exaggerated. It was the Commission’s first advertising sanction of a crypto exchange. No fine was imposed. Both figures appear on the current fee page, applied to different order types, which is a defensible structure; the finding was about how the change was presented, not about the numbers being fictitious.

Deposit and Withdrawal Fees

Upbit states that the won withdrawal fee is paid on to a related institution and that digital asset withdrawal fees are used for blockchain network transfer costs, and that VAT is included in both.

Interest on Idle Won

Since 19 July 2024 Upbit has paid a deposit usage fee on won balances, at 2.1% a year before tax. It accrues on the daily closing balance across all won pockets in the account, is truncated below eight decimal places, and is paid either immediately on request in the app or automatically every three months, net of 15.4% withholding tax. Upbit quotes Article 5 of the Virtual Asset Business Supervisory Regulation as the basis and notes the rate can change.

Three groups do not get it, and the exclusions are stated in the contract as well as the help pages: members who have not completed customer verification, members with no registered real name deposit and withdrawal account, and members identified as non-residents. The same page notes that without a registered real name account, withdrawal of the accrued fee can itself be restricted.

Verification Tiers and What They Unlock

Daily limits reset at midnight. Only one real name verified account is permitted per member, and Upbit operates a one person one account policy with a 24 hour block on rejoining after leaving. Per asset single withdrawal caps differ by asset and are published separately.

Proof of Reserves

Upbit runs two separate exercises here and they are easy to confuse, so this section keeps them apart. There is a quarterly agreed upon procedures engagement by an external accounting firm, running since 28 June 2018, which tests what Upbit holds against what it owes members. And there is a daily reconciliation Upbit performs itself, which compares customer balances against on chain balances. The quarterly one does far more work; the daily one is more current. Neither is an audit, and the quarterly report says so in terms.

The Quarterly External Engagement

Upbit commissions an outside accounting firm every quarter and publishes the result on its notice board, under the same Digital Asset eXchange Alliance wallet operation best practice that governs the daily file. The firm signing the recent reports is BDO성현회계법인, a BDO member firm, signed by its chief executive 윤길배. Upbit’s own notices shorten this to 성현회계법인, dropping the network name. We have not seen the firm give itself an English name, so any romanisation of 성현 in this review would be ours rather than anything published, and we have left it in Korean. The network affiliation is worth knowing on its own: this is a BDO member firm, not a standalone local practice. The January 2020 report in the same series named a different firm, JIAN Accounting Corporation (지안회계법인), which Upbit’s own English text renders “JIAN Accounting Corporation”. The series is unbroken from August 2018 to the present.

What kind of engagement this is matters, and the report is explicit about it. The document is headed Report on the Results of Performing Agreed-Upon Procedures (합의된 절차 수행결과 보고서), a report on the results of agreed upon procedures, performed under the Korean Institute of Certified Public Accountants’ 2006 agreed upon procedures standard, under a contract with Upbit dated 15 March 2026. In an engagement of that kind the practitioner carries out steps the client agreed in advance and reports what it found. It reaches no opinion and no conclusion. The report says all of this on its face: that the procedures are not an audit under auditing standards nor a review, that the firm therefore “expresses no assurance whatever (어떠한 확신도 표명하지 않습니다)”, expresses no assurance whatever, that it makes no representation about whether the agreed procedures are even appropriate for the purpose, that for this engagement it is not obliged to meet auditor independence requirements, and that the report is for Upbit’s information and may not be distributed for other purposes. Upbit publishes it anyway, which is to its credit, but nobody should read the word audit into it.

The scope count jumps sharply at the last report, from 307 assets to 783, on the same wording in the notice. We could not establish from the notices what changed, and the most likely reading is that the count widened beyond assets currently supported for trading, which would fit the July report being the one that had to deal with three assets whose networks had shut down. Treat the figure as the scope Upbit states rather than as a like for like series.

Having said what it is not, the procedures themselves are substantive, and more so than the notice summaries suggest. The 1 July 2026 report sets out ten. Beyond comparing holdings to user balances and reconciling against blockchain queries, they include:

• A proof of control test. The practitioner picks a wallet the company controls, at its own choosing, tells Upbit to move a small specified amount to another Upbit wallet, and then confirms on chain that the transfer happened as instructed. That is a live demonstration of control, not a paper reconciliation.
• A cryptographic signature test. The practitioner picks a wallet, supplies its own message, has Upbit sign it with the wallet’s key, and verifies the signature. This is the step that distinguishes controlling a wallet from merely pointing at one.
• Bank confirmation and segregation. Cash and user deposits are reconciled to balance certificates obtained from the financial institutions themselves, and the practitioner records confirming that user deposits are held in a separate user deposit account. That is third party evidence of the cash and of the segregation, rather than Upbit’s word for either.
• A roll forward. User balances at the as at date are reconciled back to the previous quarter’s balances plus the intervening trading and transfer history, and separately against the user register.

Fieldwork runs at Dunamu’s head office and data centre for three to four weeks around the as at date, 29 June to 23 July 2026 for the 1 July report, which is signed 27 July 2026. Unlike the daily file, the quarterly exercise does suspend transfers for the assets being counted, which is why a deposit and withdrawal suspension notice appears alongside each one.

The most useful feature of the current report is that it names what fell short. The 1 July 2026 report identifies five assets where the user wallet held less than the amount entrusted, and gives the quantity, the percentage, the cause and the remedy for each:

• ICZ, 9,815.38 short, 100.00%, and ADD, 7,909.19 short, 100.00%, and BTM, 858.32 short, 19.36%. In each case the asset’s network had ceased operating before the as at date, so the on chain balance could not be queried at all. Upbit says it confirmed the network shutdown and notified the affected members.
• PRO, 20.00 short, 0.03%, and DMT, 12.41 short, 0.01%. Timing differences in separating user assets from the firm’s own; Upbit states there was no shortfall once its own holdings were counted, and that the difference has been made good.

An exchange that publishes the five lines where its count did not tie, with quantities and causes, is doing something most do not, and a signature test against a wallet the practitioner picked is real evidence of control. Hold two things in mind alongside that. Upbit chooses which procedures to agree, so the scope is the firm’s as much as the accountant’s, and the practitioner states it is not required to be independent and expresses no assurance on any of it. And control of a wallet is not the same as a proof that every individual user balance is included in the total: there is no per user cryptographic proof here of the Merkle tree kind.

The Daily Reconciliation

Between quarters, Upbit publishes a daily file on its disclosure medium headed daily reconciliation results (일일대사 결과). The report we read is dated as at 24:00 KST on 12 August 2026.

The basis is stated on the report: the ratio is the total of customer balances inside Upbit against balances on the distributed ledger, struck at 24:00 KST each day and published the following day.

What the Daily File Does Not Cover

These caveats apply to the daily file specifically. The quarterly engagement above answers several of them, which is exactly why the two should not be read as one thing.

• Nobody outside Upbit is involved in the daily file at all. No accountant, no control test, no signature verification. It is the exchange’s own count of the exchange’s own wallets, published between the quarterly engagements rather than instead of them.
• It is a snapshot without a freeze. Upbit states the daily reconciliation runs without suspending deposits and withdrawals, so network state, pending transactions and wallet operations can produce quantity differences. That is why ratios sit slightly above 100 rather than exactly on it, and it is the main methodological difference from the quarterly count, which does halt transfers.
• It compares balances, not obligations in the round. The daily comparison is customer balances against on chain balances. The quarterly engagement is the one framed against amounts payable to members. Neither speaks to the firm’s other liabilities, its solvency, or whether assets are encumbered.
• It covers supported assets only, as at the aggregation date, and Upbit notes the ratio may differ from other disclosures or from the quarterly result because the scope differs.
• It says nothing about the hot and cold split. A 100% holding ratio is consistent with every coin sitting in a hot wallet, which is precisely the exposure that produced two thefts.

What the Two Thefts Did and Did Not Change

It is tempting to read the January 2020 report, which addressed the 2019 theft directly and reported 100.83% coverage of crypto payable to customers across 202 assets, as a response to it. It was not. It was the next scheduled quarterly, falling between the reports of 30 October 2019 and 20 April 2020. The same pattern held after November 2025: the next scheduled engagement went ahead, with fieldwork beginning on 29 December 2025, roughly a month after the breach, and reported 103.19%. So the honest comparison is not that one theft got an audit and the other did not. It is that the cadence did not change either time, and that neither theft drew an additional accounting engagement beyond the one already in the calendar. The 2025 breach did draw a regulatory response, in the roughly seven month Financial Supervisory Service inspection recorded in the incident table, which is a different kind of scrutiny and is not finished.

The Statutory Backstops, and What Is Not Published

Three statutory requirements sit underneath both disclosures, and they are itemised in Licences & Custody. Two of the three leave a trace a user can see. The deposit rule surfaces as the 2.1% deposit usage fee the same rulebook requires alongside it, and the quarterly engagement confirms the cash against bank certificates. The cold storage floor of 80% surfaces in a newsroom disclosure dated 10 December 2025 putting Upbit at 98.33% cold and 1.67% hot as at the end of October 2025, published on no fixed cycle. The third, the insurance or reserve figure, is not published at all, and the Act does not require it to be.

The practical position for a user is this. Your won is segregated at a bank, is your property in law, cannot be attached by the exchange’s creditors, ranks ahead of them in an insolvency, and its sufficiency is confirmed quarterly against certificates from the banks themselves. Your coins are backed above one for one on both a daily self published count and a quarterly external one, are subject to an offline storage floor you can see a figure for but not a series, and are covered by an insurance or reserve arrangement whose size and provider you cannot see. On both of the occasions the coins were actually taken, in 2019 and in 2025, what closed the hole was Dunamu’s own balance sheet rather than any of those mechanisms.

Listed Assets

On 13 August 2026 Upbit’s public market API returned 831 markets across 351 distinct assets: 283 KRW pairs, 322 BTC pairs and 226 USDT pairs. That is a very wide book by the standards of a single country exchange, and the KRW side in particular carries assets that have no liquid market anywhere else.

Market Structure

Upbit also runs an NFT marketplace and an Upbit Biz arm, both outside the scope of the exchange terms and each with their own contract.

Who Decides What Gets Listed

Upbit decides. There is a public route for a project to inquire about listing and a separate channel for reporting improper approaches, and Upbit’s own escalation page names the conduct it wants reported: a demand for payment in return for listing support made by an Upbit employee or a subsidiary’s staff, or by a third party impersonating Upbit employees or using spoofed Upbit email addresses. Publishing that channel at all is a reasonable signal about a market where listing bribery is a live problem.

The Virtual Asset User Protection Act bans a VASP from trading in coins issued by itself or its related parties, which removes the worst version of the conflict. It does not remove the ordinary one: an exchange that earns fees on volume decides which assets generate volume.

Delisting and Warnings

Delisting runs as a published process. A trading support termination notice names the asset and the exact date and time trading ends, typically a month out, and separate notices cover the deposit and withdrawal cutoffs. In the notices we read, BONK was given a 7 September 2026 termination date announced on 7 August 2026.

Before delisting comes the warning designation (거래 유의 종목). On 13 August 2026, 15 of 831 markets sat under one, covering assets including RVN, STORJ, ZIL, TT, SNX, JASMY, BONK and SPURS. A designation is a formal notice that Upbit is reviewing whether to keep supporting the asset, and it is published as its own notice rather than buried in a status field.

Layered on top is the caution system described in Trading & Execution: 211 markets carrying at least one caution flag, most of them for global price differences. Between the alert page, the warning designations and the API flags, the disclosure around individual listings is better than the norm, and a user who reads none of it will still see the flags in the interface.

Asset Support Status

Upbit publishes a live deposit and withdrawal status page covering every supported wallet, with the network, whether the block state is normal, the current block height, how recently it updated and a reason where the wallet is suspended. On 13 August 2026 it listed 358 wallets: 347 open for both deposit and withdrawal, and 11 temporarily suspended. The published reasons were network maintenance (4), wallet upgrade (3), warning designation (2), wallet inspection (1) and project closure (1).

That page is the single most useful thing on the site for a user deciding whether to move an asset today, and it is the sort of disclosure most exchanges either do not offer or bury.

Research & Tools

Upbit’s research surface is built for an active retail trader in a single market, and within that scope it is well provisioned.

Charting

The exchange embeds the TradingView charting library, loaded directly from Upbit’s own asset host, which brings the standard drawing tools, indicator set and timeframes into the exchange interface rather than requiring a second tab. Charts are available on web and in the mobile apps.

Market Indices and Sentiment

Upbit publishes its own indices on the homepage and through its DataLab property. On 13 August 2026 the Upbit Composite Index stood at 9,299.55 and the Upbit Altcoin Index at 2,361.50, alongside a Fear and Greed index reading 47 out of 100, described as neutral, and a rolling 24 hour turnover figure. Homepage boards rank assets by one hour turnover, market capitalisation, and one hour gainers and losers.

DataLab itself is a separate property carrying market trend analysis, and the Fear and Greed and turnover indicators each have their own permanent pages. This is more market data than most exchanges publish for free, and none of it requires an account.

Asset Information Pages

Each listed asset carries an information page with supply and market capitalisation data. Upbit is explicit about where that comes from and disclaims it in terms worth quoting, because it is the honest version of a disclosure most venues fudge: the figures reflect what the project itself, CoinMarketCap and CoinGecko provide, and Upbit states it takes no part in calculating total supply, circulating supply, distribution schedules or market capitalisation, that it accepts no legal responsibility for investment outcomes based on the information, and that losses belong to the investor. Upbit also publishes notices when a listed project changes its circulating supply schedule.

The Disclosure Medium

The most substantive research tool on the site is the one least likely to be used. Upbit operates an electronic disclosure medium as the operator of a virtual asset market, publishing items the law specifies. In the twenty four disclosures live at the time of writing, the categories are the daily asset reconciliation, advance disclosure of benefits provided (typically a fee free trading event or a sponsorship), and sale plans and results filed by other VASPs disposing of their own holdings. Upbit states it does not guarantee the accuracy or completeness of information filed by other providers and directs questions to them.

Open API

Upbit publishes a full Open API documented at its developer centre. It covers whole account balance queries, order lookup, order placement and cancellation, and, with a registered withdrawal address, digital asset withdrawal. There is a separate Open API terms of use, and API access is subject to the same customer verification and two channel authentication gates as the interface.

Education

The user guide runs as a help centre with 534 Korean articles covering verification, transfers, the travel rule, tax certificates, staking, lending and fraud prevention, and it is updated continuously. There is also a mandatory education and test requirement, run to a DAXA eligibility standard, before Coin Lending can be used, which is a rare instance of an exchange gating a leveraged product behind demonstrated understanding rather than a checkbox. Fraud awareness material is substantial and specific, covering QR code phishing, unrequested two channel authentication approvals and voice phishing patterns.

Earn, Staking & Lending

An exchange’s yield products are where a user most often gives up something they did not realise they had. Upbit runs three, and on the title question its staking terms are better than the industry norm, while its lending product carries a risk most users will not price correctly.

Staking

Upbit Staking delegates supported assets to validators Upbit runs itself. The terms are unusually clear about what the product is not, and the disclaimers are the most important part.

• Title does not transfer. The terms state that rights in staked assets remain with the member, and that Upbit does not use them for any investment, asset acquisition or management, only for the staking the member requested. Its help centre adds that it does not entrust them to any external company. That is the opposite of the arrangement at exchanges where staking passes ownership.
• It is expressly not a financial product. Article 3 opens by stating that Upbit Staking is not a financial or investment product or service, but a technical agency service. The product page adds that it is not protected by the Capital Markets Act or the Financial Consumer Protection Act.
• The fee is 10% of rewards. Upbit’s help centre states that it aggregates rewards over the 24 hours from 09:00 KST daily and distributes them after deducting a 10% commission. The terms themselves say only that a fee applies and varies by asset, with the figure published per asset.
• Your assets are locked and excluded. From the moment of staking until unstaking completes, the assets are removed from tradable and withdrawable balances. Network unbonding periods mean the return is not at a time of your choosing, and assets sitting in a staking or unstaking queue earn nothing.
• Rewards are not guaranteed. The terms say Upbit cannot influence reward rates and gives no assurance about them. The Ethereum estimated annual reward rate showed 2.41% when we looked.
• The liability carve outs include hacking. Upbit does not pay delay damages for reward delays caused by network errors, telecom or security provider fault, or hacking and malware incidents, except where it acted with intent or negligence. Quantities are maintained “unless there are exceptional circumstances such as hacking of the blockchain network”, and where quantities are lost through Upbit’s intent or negligence, recovery is supported under its own policy rather than a stated guarantee.

Coin Lending

Coin Lending (코인빌리기) lets a member borrow one asset against collateral in another. Structurally it is a loan for consumption with a pledge over the collateral, and it is the closest thing on Upbit to leverage.

Eligibility is tight: Korean individual members who have completed customer verification, with at least ten virtual asset trades in the past year and at least 5 million KRW of assets, who have passed the DAXA eligibility assessment including mandatory education and a test. Corporate members and, on the face of the criteria, foreign national members are outside it.

The full liquidation mechanics, the 0.05% daily usage fee, the 1% forced repayment fee, the 95% forced repayment ratio, the 30 day maximum term and the collateral haircuts are set out in Trading & Execution. The point to carry away here is the one the terms make in plain language: if prices move sharply, the loss can exceed the collateral, the shortfall remains owing, and Upbit may claim it. Collateral is frozen from the moment it is posted until the loan is fully repaid, regardless of how comfortable the ratio looks.

Recurring Buy

Recurring Buy (코인모으기) is scheduled dollar cost averaging: pick a date and an amount and Upbit buys automatically until a target date. It has its own terms and is the least complicated of the three products.

Promotions

Fee free events run on selected pairs. At the time of writing one covered the KRW pairs for USDT, USDC, USDE, USDS, USD1, RLUSD and USDG, with the end date extended to 16 August 2026. These are disclosed in advance on the statutory disclosure medium as provision of a benefit, which is a better standard of disclosure than a banner. Upbit warns that whether a limited period event applies is judged at the moment the order is submitted, and event pricing is not a stable basis for choosing a venue.

Opening an Account

This is the section that will end the process for most readers of this review. Upbit’s Korean exchange is gated on Korean infrastructure, not on nationality, and the gates are hard.

The Two Conditions

Upbit’s own signup guide lists them as prerequisites, both of which must be satisfied before verification can even start:

1. A mobile phone in your own name on a Korean carrier. A company phone works only if you are registered with the carrier as the actual user.
2. A bank or securities account in your own name at a Korean institution.

Beyond those, Upbit’s terms give it grounds to refuse an application outright, and the list includes an applicant who is “a non-resident, a foreign corporation or a minor”. It also includes nationals, residents or people staying in a country assessed as high risk under the Specific Financial Information Act and FIU guidance. Both clauses appear in identical terms in the Korean and English texts.

The Steps

1. Install the app. Signup for individuals is app first; several later steps cannot be completed on the web.
2. Phone identity verification.
3. Bank or securities account verification.
4. Set a six digit PIN, optionally biometrics, choose a nickname, accept the terms.
5. Customer verification: consents, mandatory information, ID document capture, and verification of a bank account in your own name. Completing this unlocks digital asset deposits and withdrawals and trading on the BTC and USDT books, with withdrawals through PC web only.
6. Two channel authentication, via KakaoTalk, a Naver certificate or a Hana certificate. Completing this unlocks won deposits and withdrawals, the KRW book, and transfers from the mobile app.

Customer verification asks for occupation and occupation detail from published lists, employer name and workplace address, purpose of transaction and source of funds. Upbit rejects entries that name a job in the employer field and requires re-verification, during which trading and transfers can be delayed or restricted.

Identity Documents

For Korean nationals only a resident registration card or a driver’s licence is accepted. Upbit’s help centre is explicit that a passport cannot be used for a Korean national, citing the relevant law, which is why a Korean living abroad with only a passport cannot complete verification.

For a foreign national living in Korea, verification is available and the requirements are specific: one of an alien registration card, an overseas Korean domestic residence report card or a permanent residence card, plus one of a domestic residence fact certificate or an alien registration fact certificate, each issued within 90 days and with at least 30 days left on the stay. Document review takes around five business days. ID capture is possible only in the mobile app.

The full list of who is excluded and on what authority is set out as a table in Restricted Countries. Two exclusions belong here because they are procedural rather than jurisdictional: the corporate signup flow states that a sole trader cannot join as a corporate member, and a member identified as a non-resident, even one who already holds an account, does not receive the deposit usage fee and may have tax withheld on digital asset income.

Using the Account From Outside Korea

Upbit sets out four conditions for use from abroad: a phone in your own name on a Korean carrier, a K Bank account in your own name, two channel authentication, and the overseas login block feature switched off. Even then it warns that K Bank’s automated telephone verification may not work from abroad, which blocks real name account verification, and that each of the three certificate providers restricts overseas issuance or reissuance. A certificate issued in Korea cannot be reissued to a foreign number.

Where two channel authentication cannot be set up, the account is materially degraded: no won deposits or withdrawals at all, digital asset withdrawals only through the PC web and not the app, and a withdrawal cap of 100 million KRW. Upbit also offers an overseas login block that, once on, prevents login from any foreign IP address, and it warns that a user who cannot switch it off has to call support.

A separate obligation arrived on 1 January 2026: under the crypto asset reporting framework implementation rules, members must submit an identity certificate covering foreign tax obligations. Refusing, delaying or falsifying it can restrict service and can be reported to the National Tax Service.

Deposits & Withdrawals

Won moves in and out of Upbit through exactly one channel, and that channel is the single most consequential operational fact about the exchange.

The Real Name Verified Account, and the Bank

The Specific Financial Information Act requires a Korean exchange to run won movement through a real name verified deposit and withdrawal account, defined in the statute as an account permitting financial transactions only between the exchange’s account and the customer’s account at the same financial institution. Upbit’s terms restate this. The effect is that your won sits in an account at a named bank, in your verified name, and cannot move anonymously.

That bank is K Bank (케이뱅크), and no other. Upbit’s help centre says so in as many words: only a K Bank deposit and withdrawal account can be verified, and accounts at other banks cannot. The distinction Upbit draws elsewhere is worth keeping: an account at another bank can be used for the ownership check during signup, but won deposits and withdrawals require a K Bank linkage. Members without a K Bank account are pointed at K Bank’s app to open one.

What that arrangement does and does not guarantee. It guarantees that won cannot enter or leave the exchange except through an account in your own verified name at one identified bank. It is an identity control that closes the anonymous deposit channel, and it is the mechanism that allows the exchange to operate at all. It is not deposit insurance on your crypto holdings, and it is not a segregation regime for coins, which comes from a different statute entirely and involves a managing institution Upbit does not name. Upbit’s own operational notes make the dependency visible from the other direction: won deposits and withdrawals are unavailable during the bank’s daily maintenance window from 23:56 to 00:06, K Bank limited accounts cap deposits at 5 million KRW, and a K Bank account unused for over a year requires renewed direct debit consent before won can be deposited.

We could not establish that Korean deposit insurance reaches an individual Upbit user’s won balance. The Depositor Protection Act enforcement decree in force from 1 September 2025 does not mention virtual assets at all, and the protection limit itself rose from 50 million to 100 million KRW on that date. What the Virtual Asset User Protection Act gives instead is stronger in one respect and weaker in another: the deposits are declared user property, cannot be set off or attached, and rank ahead of other creditors on the exchange’s failure, but there is no insurer standing behind them.

Limits and Fees

Full limits by verification stage are in Accounts & Fee Tiers. In summary: won deposits and withdrawals are impossible without a registered real name account, and capped at 100 million KRW per transaction and 500 million per day once one is registered, halved or worse on a K Bank limited account. Digital asset deposits are unlimited. Digital asset withdrawals run to 100 million KRW a day without two channel authentication and 5 billion with it. Won deposits are free with a 5,000 KRW minimum; won withdrawals cost 1,000 KRW flat.

The Travel Rule, and Where You Can Send Coins

Transfers of one million KRW or more trigger travel rule handling, and Upbit publishes exactly which counterparties it will deal with at that size. As at 30 June 2026 the domestic list ran to 23 named providers including Bithumb, Coinone, Korbit, Gopax, KODA and KDAC. The overseas list named Upbit Singapore, Upbit Indonesia and Upbit Thailand alongside OKX, Bybit, Binance, BitMEX, Bitget, Crypto.com, HTX, Gate, Backpack and others, with a deposit only tier covering Okcoin, Coinbase, Bitbank and Kraken.

Separately, and dated 23 June 2026, Upbit publishes a list of unreported virtual asset service providers to and from which transfers are restricted regardless of amount, under the Specific Financial Information Act and financial authority guidance. It ran to exactly forty names including KuCoin, MEXC, Phemex, XT.com, Bitrue, CoinW, CoinEx, Poloniex, DigiFinex, Pionex, BitMart, BingX and WEEX. Below one million KRW, transfers to a personal wallet are possible after address verification; at or above it, only registered personal wallets and travel rule connected providers qualify.

One entry on the supported list carries an asterisk marking withdrawals as restricted. That is HTX, and the reason is on the notice board: on 27 May 2026 Upbit halted all withdrawals to HTX after its operator was designated by UK financial authorities.

Live Wallet Status

Upbit publishes a per asset deposit and withdrawal status page with block state, block height and a reason for any suspension. On 13 August 2026 it showed 358 wallets, 347 fully open and 11 suspended, with reasons given. See Listed Assets for the breakdown. Suspension notices are also posted individually, with the exact start time.

Incident and Withdrawal Halt Record

This is the record that matters most on a page like this. Every row is dated, and each is labelled with what kind of claim it is: what was ALLEGED, what the FIRM SAID, what a REGULATOR ORDERED, and what a COURT FOUND. Those are different things and they are routinely run together.

Two observations about how this record is communicated, both of which come from reading the notice board rather than from any single item on it. Across all 5,721 notices Upbit has ever posted, the words administrative fine (과태료), business suspension (영업정지) and money laundering (자금세탁) appear in zero titles. The February 2025 sanction was posted, but under the phrase “a sanction by the financial authorities” (금융당국의 제재조치). No notice title mentions the 35.2 billion KRW fine, and the bodies we were able to read in the weeks around the imposition and the objection do not mention it either. And where the 2019 hack notice was published bilingually in a single body, the November 2025 notice body is Korean only.

Customer Support

Upbit’s support is built for a Korean user and is thin for anyone else. Judged on the thing that matters most for an exchange, which is how it behaves during an incident, its record is documented and mixed rather than either exemplary or evasive.

Channels and Hours

Upbit states plainly that it does not take walk in consultations at head office. Inquiry categories are published: account, deposits and withdrawals, usage, and partnership or other. There is no general support email address. The only address published on the site is [email protected], which is for partnership enquiries, so written contact runs through the 1:1 ticket or KakaoTalk.

The Language Gap

The site toggles between Korean and English, and the terms of use exist in both. The help centre does not follow. Queried through its own API, the Korean help centre returns 534 articles and the English one returns 2. Every substantive guide, on verification, foreign resident documents, the travel rule, staking, lending, tax certificates and fraud, exists in Korean only.

Telephone support is Korean. This is coherent with an exchange that only serves Korean residents, and it is worth stating for what it implies: a foreign national living in Korea, who is precisely the user Upbit does accept and whose verification is the most document heavy on the platform, is served in a language they may not read.

Incident Response, Which Is the Real Test

Weighted for incident response, the record reads as follows.

Both hot wallet thefts are set out with dates and amounts in the incident table in Deposits & Withdrawals. What is relevant here is how the firm behaved, and the pattern is consistent across six years. Both times the CEO signed the notice personally, named the amount, and committed to covering the loss from company assets before anyone had forced the point. In 2025 the apology came the next day and attributed the breach to Upbit’s own inadequate security management, with a stated root cause, which is not the industry norm.

The failures in that behaviour are equally consistent. In 2019 Upbit estimated resumption at “at least about 2 weeks” and took closer to two months. In 2025 it published a loss figure it then had to correct downward, resumption took about eight days with every deposit address reissued, and there was a further short outage on the way. The 2019 notice was published bilingually in a single body; the 2025 notice body was Korean only.

Set against that openness about operational failure is a marked quietness about regulatory failure. Across every notice Upbit has ever posted, no title has used the words for administrative fine, business suspension or money laundering, and no title mentions the largest fine in its history.

Security Tooling on the User’s Side

Upbit provides two channel authentication through KakaoTalk, Naver and Hana certificates, a fraud detection system it describes as learning transaction patterns to identify and block anomalies, an optional overseas login block, a bug bounty programme at its own subdomain, and a privacy centre. Its fraud material is specific and current, covering QR code phishing, unrequested two channel approvals and impersonation of Upbit staff. The gap on the user’s side is not tooling.

Restricted Countries

Upbit’s Korean exchange does not publish a list of prohibited countries in the way an international broker does, because it does not need one. The access model excludes almost everybody by construction, and the explicit exclusions that do exist are drawn from the firm’s own words.

Who Is Excluded, and On What Basis

Upbit names the country risk sources rather than the countries. That is a defensible design, since the FATF and OFAC lists change, but it does mean a prospective user cannot check their own position against a published list and has to attempt verification to find out.

Restricted Counterparties, Which Is the Other Half

What Upbit does publish, in detail, is which venues it will and will not exchange assets with. Two dated lists carry this, both covered in Deposits & Withdrawals: the travel rule supported list of 23 domestic and 15 or so overseas providers as at 30 June 2026, and the unreported virtual asset service provider list of exactly forty overseas venues as at 23 June 2026, transfers to and from which are restricted regardless of amount. HTX sits on the supported list with withdrawals restricted, following the UK designation of its operator in May 2026.

For a user, the practical restriction is usually this one rather than a country. If your other exchange is on the unreported list, your coins cannot move between them at any size.

If You Are Outside Korea

Three other group entities serve Singapore, Indonesia and Thailand. They are separate companies with separate contracts, separate regulators and separate books, and the matrix naming each of them is in Licences & Custody. Anywhere else, no Upbit entity serves you, and a site that offers to is one of the impersonators the Thai regulator has already flagged.

Conclusion

Upbit is a real, large, heavily supervised exchange whose supervision is not the kind most people assume it is. The distinction is the whole review. KoFIU accepted Dunamu’s report in October 2021 and its renewal in December 2025, and that is anti money laundering supervision, not permission to hold your coins. Korea grants no such permission to anyone. What actually protects a user’s assets are the duties in the Virtual Asset User Protection Act, and those bind Upbit whether or not anybody has approved of it.

Measured against those duties, Upbit does well on the parts you can see and leaves the parts you cannot see unverifiable. Reserves are evidenced twice: a BDO member firm running agreed upon procedures every quarter since June 2018, at 103.27% of digital assets and 118.29% of money payable as at 1 July 2026 with the five short assets named, and a self published daily reconciliation covering 351 assets in between. Neither is an audit, and the quarterly report is explicit that it expresses no assurance, but the procedures include making Upbit prove control of a wallet the accountant picked. The deposit usage fee is real and quantified at 2.1% a year. The disclosure medium, the live wallet status page, the market alert log and the warning designations together give a user more visibility into what is happening to their assets than most exchanges anywhere provide. But the bank holding the segregated deposits is not named, the insurance or reserve figure is not published at all, and the cold storage figure, a measured 98.33% against a statutory floor of 80% as at the end of October 2025, reaches the reader through a newsroom article on no fixed cycle rather than a periodic disclosure.

Then there is the thing that keeps happening. Upbit’s hot wallet has been emptied twice, in November 2019 and November 2025, six years apart to the day. Dunamu covered both from its own balance sheet, and its CEO said in public within a day of the second one that the cause was Upbit’s inadequate security management and a vulnerability letting private keys be inferred from public on chain transactions. That candour is genuinely unusual. It does not change the fact that the protection which worked, on both occasions, was a private company choosing to pay, not a regulator, a scheme or an insurer.

The regulatory record is live and should not be described as settled in either direction. A 35.2 billion KRW fine was imposed in December 2025 and formally objected to in February 2026, which under Korean law strips the imposition of effect and sends it to a court, so it is neither final nor paid. A three month partial suspension was ordered in February 2025, stayed in March, cancelled by the Seoul Administrative Court in April 2026 and appealed by KoFIU that same month. The criminal case against Dunamu executives, by contrast, is finished: acquitted at first instance, on appeal, and finally by the Supreme Court in November 2023. Reporting an accusation as a finding, or a contested fine as a paid one, would misrepresent all three.

Two things a reader should treat as warnings rather than quibbles. The English terms of use are missing the deposit segregation clause that the Korean Article 9 carries, in a document that also states the Korean prevails; an English reading user is looking at an obligations article with the custody promise removed. And Upbit’s notice board, across 5,721 posts, has never used the words for administrative fine, business suspension or money laundering in a title, and no title mentions the largest fine in its history. This is a firm that talks openly about being hacked and quietly about being sanctioned.

Upbit suits a Korean resident who wants the deepest won liquidity available, a very wide listing book, the cheapest spot fees in the market at 0.05% each side, and transparency tooling that is genuinely better than the norm. It does not suit anyone outside Korea, who cannot open an account and should be alert to the impersonation sites the Thai regulator has already flagged. And it does not suit anybody, Korean or not, who is holding a large balance on the assumption that a regulator, a compensation scheme or a named insurer stands behind the coins. On the evidence, what stands behind them is Dunamu, and Dunamu has had to step in twice.

FAQ