South Korea's FSC to Let Crypto Exchanges Freeze on Suspected Hacks

South Korea's Financial Services Commission said on Thursday, November 12, 2026, that it will issue a no-action letter allowing crypto exchanges to suspend deposits and withdrawals when hacking is merely suspected — before any breach is confirmed. The move reverses the sector's long-standing rule that platforms could only act once an incident was verified, and it arrives after a six-week wave of cyberattacks that hit more than 37 financial firms and drained roughly 1 billion won from hot wallets and other targets.

The mechanics are simple. A no-action letter is a regulator's written promise not to penalize a specific behavior, in this case preventive suspensions under certain conditions. The FSC did not detail those conditions in its announcement, and that gap matters. A loosely defined trigger could let exchanges freeze user funds for operational convenience. A tightly defined one could leave them hesitating in the very minutes the policy is meant to protect.

What forced the regulator's hand?

Two recent incidents shaped the decision. On November 6, 2026, the exchange GOPAX suspended operations after receiving a threatening email, moving assets into cold storage even though no breach had been confirmed at the time. Under existing rules, that precaution sat in a legal gray zone — exactly the uncertainty the no-action letter is designed to remove.

The second case involved real losses. On October 24, 2026, the platform Prabang lost approximately 100 million won (about $70,000) from its hot wallet — the internet-connected wallet exchanges use to process everyday withdrawals. Prabang pledged to compensate affected customers from company funds, a decision that raises a quieter structural question: not every small exchange has the balance sheet to absorb such losses, which is partly why prevention now outweighs compensation in the FSC's thinking.

The backdrop is broader than crypto. According to the research findings underpinning the announcement, more than 37 South Korean financial firms suffered cyber incidents between late September and early November 2026. Around 473,000 records were exposed. The FSC convened an emergency meeting on November 2 as the attacks escalated and has since pressed exchanges to tighten security protocols.

What does this change for exchanges and users?

For platforms, the shift from "confirmed breach" to "suspected breach" is operationally significant. Attacks often unfold in minutes, and the previous confirmation requirement forced exchanges to choose between moving fast and staying compliant. The letter gives them legal cover to act on early indicators, as GOPAX did.

For users, the trade-off cuts both ways. Faster freezes can stop theft before funds leave the platform. But an undefined suspicion standard means withdrawals could halt without a verified attack, and the FSC has not yet said how long a freeze may last.

The FSC is also pushing a second lever: cold storage. South Korean exchanges must currently keep at least 80% of customer assets in cold wallets, which are offline and far harder to reach remotely. The regulator has called for raising that minimum. Tougher asset-management rules of that kind carry their own cost — holding more assets offline slows the processing of large withdrawals and reduces operational flexibility, a constraint liquidity desks will have to plan around.

What comes next

Two details will define how the policy works in practice. The first is the fine print of the no-action letter: how "suspected hacking" gets defined, and what time limits apply to any suspension. The second is the level at which the FSC sets any new cold-storage minimum above the current 80% floor. Both should become clear as the letter's conditions are published and implemented in the coming enforcement cycle.