Upbit review: Korea’s dominant exchange, cheap and certified, but Korea-centric, hacked twice and under regulatory pressure.

Upbit, operated by Dunamu, was the first crypto exchange to receive South Korea's ISMS certification, added ISO 27001, 27017 and 27018 in 2018 and ISMS-P in September 2021 (Korean press reports). One aggregator says 95% of user funds are held in cold wallets, which we could not confirm from a primary source. The breach record is the weak point: a hot-wallet theft of about 342,000 ETH (roughly $50 million at the time) on November 27, 2019, and a second hot-wallet theft on November 27, 2025, when Solana-network tokens worth about 44.5 billion won (roughly $30 million) were moved to an unknown wallet. Upbit's first estimate was 54 billion won (about $36 million) before it re-priced the assets to the time of the transfer. Upbit said its cold wallets were untouched, moved the remaining hot-wallet assets to cold storage and said Dunamu would cover all losses from company funds. One aggregator reports that $26.4 million was reimbursed to users, that $4.03 million was a corporate loss and that $1.57 million was frozen; we treat those splits as reported, not confirmed. The disclosure timing drew criticism because the announcement followed a Naver merger event held the same day, and in July 2026 the Financial Supervisory Service (FSS) opened a sanction process over the hack. We did not find a current published proof-of-reserves attestation in the sources we reviewed.

Upbit Korea is registered with South Korea's Financial Intelligence Unit (FIU) as a virtual asset service provider; it was the first exchange to register, in August 2021, and its real-name banking partner is K Bank. The enforcement record is heavy. In February 2025 the FIU imposed a three-month partial suspension on onboarding new customers for virtual asset transfers, over dealings with unregistered overseas providers; a Seoul court lifted that suspension in March 2025, reportedly because of gaps in its legal basis. In November 2025 the FIU fined Dunamu 35.2 billion won (about $25 million); one report cites about 5.3 million violations, and another source gives a larger figure we did not rely on. As of February 2026 Dunamu had not said whether it would pay or contest the fine, and we could not confirm the outcome. Outside Korea, Upbit runs separate entities: Upbit Singapore holds a Major Payment Institution licence from the Monetary Authority of Singapore (January 2024), and company statements from 2024 describe Thai SEC and Indonesian BAPPEBTI regulation for the Thai and Indonesian arms, which we did not re-verify. Upbit does not serve US or UK residents. The parent is also in transition: Naver Financial's roughly $10.3 billion all-share takeover of Dunamu, announced in November 2025, has been delayed twice, with a shareholder vote set for November 19, 2026 and a completion deadline of December 31, 2026, pending antitrust and financial-regulator approvals.

Upbit's pricing is simple and low on its main market. CoinGecko lists 0.05% maker and taker on Korean won (KRW) limit orders, 0.139% on stop-limit orders and 0.25% on the BTC and USDT markets, with no volume tiers and no native-token discount. A 2026 review reports no fee for KRW deposits or withdrawals, with only network fees on crypto withdrawals; per-coin withdrawal fees vary. From July 26 to August 9, 2026 Upbit waived the 0.05% fee on stablecoins in its KRW market as a promotion, which is temporary. Two cautions apply. The low rate is on the won market, which needs a Korean bank account, and the 0.25% crypto-denominated markets are higher than several offshore competitors. CoinGecko's trust data also shows a wide average bid-ask spread of 9.19% and a low liquidity grade, which looks inconsistent with Upbit's volume and probably reflects thin altcoin pairs, so we treat that figure as unreliable. We could not load live fee pages for Upbit Singapore, Indonesia or Thailand.

Upbit is a spot-only exchange with no margin, perpetual contracts or leverage products (Solana Compass, CoinMarketCap). Counts vary by source: CoinGecko shows 347 coins and 496 pairs on its English page and 326 to 330 coins on some translated pages, CoinMarketCap says over 180 coins, and a 2026 review says over 200. It lists new tokens quickly and has added stablecoin markets, including USDT in 2024 and RLUSD and USDG in 2026. A 2026 review describes staking through Upbit-run validators and a lending programme, but South Korea's Financial Services Commission ordered exchanges in late 2025 to suspend new crypto-lending products until guidelines are in place, so check whether lending is available. There are no derivatives, stocks or launchpad.

For Korean residents, Upbit is a polished and widely used app that reviewers describe as beginner friendly, with a clear interface, market data and KakaoTalk sign-up (Forkast; BoxMining, 2023). Coin Bureau describes four KYC levels that unlock more features. The barrier is access. The won market requires a real-name verified account with Upbit's partner bank, K Bank, and, for foreigners, a valid Alien Registration Card, a Korean mobile number and a bank account in the same name (secondary guides, April 2026). Most non-residents cannot open a fully functional Upbit Korea account. Upbit's Singapore, Indonesia and Thailand arms generally offer crypto-to-crypto trading without a local fiat gateway, according to a June 2026 availability guide.

Evidence on support is thin and mostly negative outside Korea. One aggregator shows a Trustpilot rating of 1.6 from 26 reviews and another cites 1.8 out of 5, small samples that may not reflect Korean users. A 2023 review praised polite support by phone, email and KakaoTalk, though that is older and from a single reviewer. We excluded Trustpilot pages for lookalike domains such as ubcoins.co, which appear to concern unrelated sites, and anonymous review-site posts we could not verify. The Korean-language experience may be better than these English-language ratings suggest.

Upbit has no native token. Its extras are strategic more than product-led: a potential tie-up with Naver, one of Korea's largest internet groups, reports of large investments in Dunamu in 2026 (a $670 million stake from Hana Bank and over $400 million from Samsung affiliates, each from a single source), staking, an API, and an Asia-Pacific group that includes the VerifyVASP Travel Rule service. The commercial picture has weakened: Dunamu reported first-quarter 2026 revenue of 234.6 billion won, down 55% year on year, and operating profit of 88 billion won, down 78%, as trading volumes fell. In a stablecoin market where Coinone and Bithumb overtook it on daily volume in June 2026, Upbit was third at 30.1%, although it held about 60% of all Korean spot volume that month by one count (another source puts its share at 72%).