South Korea Grants Exchanges Power to Freeze Withdrawals on Hacking Suspicion

South Korea's financial regulator will allow cryptocurrency exchanges to freeze user withdrawals when they suspect a hacking incident is underway, a policy shift announced after two recent exchange incidents and a broader wave of cyberattacks that exposed roughly 473,000 records across the country's financial sector.

The relief, issued by the Financial Services Commission (FSC), permits exchanges to suspend withdrawals on suspicion of a hack. The announcement did not detail the specific conditions attached to the measure, and that omission carries real weight. A loosely defined trigger could allow an exchange to freeze user funds for operational convenience. A tightly defined one could leave compliance teams hesitating during precisely the minutes the policy exists to protect.

What incidents forced the decision?

Two episodes in late 2026 shaped the timing. On November 6, the exchange GOPAX suspended operations after receiving a threatening email. No breach had been confirmed at the time, but the exchange moved assets into cold storage as a precaution — an action that, before this relief, sat in a legal gray zone for Korean platforms.

The second case involved actual losses. On October 24, the platform Prabang lost approximately 100 million won, about $70,000, from its hot wallet — the internet-connected wallet an exchange uses to process everyday withdrawals. Prabang pledged to compensate affected customers from company funds.

Those incidents were not isolated. Research findings cited alongside the announcement show that more than 37 financial firms in South Korea suffered cyber incidents between late September and early November 2026. Across those attacks, roughly 473,000 records were exposed and approximately 1 billion won was stolen from hot wallets and other targets. To put the record exposure in scale: it is comparable to the personal data of a mid-sized Korean city falling into attackers' hands in the space of six weeks.

The FSC convened an emergency meeting on November 2 as the attacks escalated and has since pressed exchanges to tighten security protocols.

What does this change for exchanges and users?

The withdrawal-freeze authority changes the operational calculus in two directions at once. For exchanges, it removes legal uncertainty around emergency suspensions — the GOPAX scenario, where a platform acted defensively without confirmed evidence of breach. For users, it introduces a new failure mode: funds locked on suspicion alone, with the duration of any freeze undefined in the current announcement.

The practical question for practitioners is where the trigger line sits and who draws it. The fine print of the relief — how "suspected hacking" is defined and how long a freeze may last — will determine whether this becomes a genuine incident-response tool or a blanket liquidity lever.

A parallel measure under review concerns cold storage. Korean exchanges must currently keep at least 80% of client assets in cold wallets, which are offline and far harder to reach remotely. The FSC has called for raising that minimum.

That proposal carries a trade-off the research notes explicitly: tougher asset management rules reduce liquidity and operational flexibility. Holding more assets offline means processing large withdrawals takes longer. For an exchange running daily redemption flows, a higher cold-storage ratio converts security into settlement delay.

The Prabang case also raises a quieter question about loss absorption. Prabang chose to cover customer losses from its own balance sheet. Not every small exchange can do the same, which is part of why preventing theft matters more than compensating for it after the fact.

What comes next?

Two details will define the policy's real impact. The first is the no-action letter's fine print — the definition of "suspected hacking" and any cap on freeze duration. The second is where the FSC sets any new cold-storage minimum above the current 80% floor.

Until both parameters are published, exchanges operate with new authority but no operational playbook, and users hold assets that can be suspended on suspicion alone.