South Korea to permit crypto withdrawal freezes when hacks are suspected

What happened

South Korea's Financial Services Commission (FSC) said on Thursday that it intends to issue a no-action letter allowing cryptocurrency exchanges to suspend deposits and withdrawals when a hacking attempt is suspected, rather than waiting until a breach has been confirmed. The plan was announced after a security meeting in Seoul chaired by FSC Vice Chairman Shin Jin-chang. Under the country's Virtual Asset User Protection Act, platforms may not block customer deposits and withdrawals without legitimate grounds, and the law names a clearly established hacking incident as the situation in which restrictions are permitted.

That leaves exchanges exposed to legal uncertainty when they spot unusual transfers or suspicious account activity but cannot yet prove an attack, according to crypto.news. The no-action letter is meant to provide regulatory assurance for preventive suspensions that satisfy specified conditions; it would not hand operators unrestricted authority to freeze customer funds. The regulator described rapid intervention as a way to limit further losses during a possible security breach.

Alongside the withdrawal rules, the FSC asked exchanges to run continuous monitoring suited to a market that trades around the clock, with responsible personnel available to investigate suspicious transactions and act immediately. Platforms that cannot maintain supervision at all hours would have to process deposits and withdrawals only when their security teams are on duty, informing customers in advance and assigning enough staff to handle requests promptly. The regulator also called for more customer assets to be kept in offline storage, hot-wallet balances limited to routine transaction needs, funds spread across several wallets, and stronger insurance coverage and reserves.

Why it matters

The change addresses a gap that has become practical rather than theoretical: South Korean exchanges have already stopped services on the basis of threats rather than confirmed thefts. Halting deposits and withdrawals protects remaining customer assets, but it also cuts off access to funds users own, which is why the existing law treated such steps as exceptional. By framing a narrow permission instead of a blanket right, the FSC is trying to let operators act on early warning signs while keeping freezes subject to conditions and oversight.

Shin argued that virtual asset companies should maintain security standards comparable to traditional financial institutions, given that they store and manage customer assets on behalf of users. The guidance also pushes exchanges toward tighter operational discipline on monitoring, storage and compensation arrangements.

What the data shows

South Korea requires virtual asset service providers to keep at least 80% of customer cryptocurrency in cold storage. The FSC says the industry-wide ratio already exceeds 95%, although individual exchanges hold different proportions, and crypto.news reported that authorities had considered tighter storage requirements following Binance's October security breach. Current guidance asks operators to limit hot-wallet balances to what routine transactions require and to consider spreading funds across multiple wallets.

Background

The guidance follows two incidents reported by Cointelegraph and crypto.news. On Nov. 6, GOPAX suspended trading, deposits and standard withdrawals after receiving an email threatening a cyberattack; the exchange moved customer assets into cold wallets and said it had found no evidence of an actual hack or theft at the time, with withdrawals handled manually through support channels. On Oct. 24, Prabang halted operations after detecting abnormal withdrawals from its hot wallet, reporting losses of approximately $70,000 and saying it would compensate affected customers using company funds.

The FSC has flagged weaknesses more broadly. In October it identified cybersecurity deficiencies at 130 of the 555 financial companies it reviewed nationwide, and it separately named GOPAX operator Streami and Prabang among 16 companies involved in earlier security incidents.

What to watch

The FSC intends to add cybersecurity duties through its proposed Digital Assets Act, which would require crypto businesses to meet IT security standards and assume liability for damages comparable to financial institutions. Exchanges would also be expected to report suspected breaches and unusual external access attempts promptly to financial authorities. Separately, the Financial Security Institute plans additional inspections covering cryptocurrency wallets, blockchain infrastructure and transaction controls, and intends to expand support for crypto businesses through threat intelligence, vulnerability assessments and specialist training; currently only five won-market exchanges among 28 registered virtual asset service providers have joined the institute.

Questions readers ask