South Korea's FSC to Let Exchanges Freeze Crypto Withdrawals on Hacking Suspicions

South Korea's Financial Services Commission will allow crypto exchanges to suspend deposits and withdrawals when a hack is merely suspected, abandoning the current requirement that a breach be confirmed before restrictions take effect. The regulator announced the change on Thursday through a no-action letter that permits preventive suspensions under defined conditions.

The shift is a direct response to operational weakness at domestic venues. Current rules prohibit exchanges from blocking withdrawals absent legitimate grounds and permit restrictions only when a hacking incident is clearly established — a standard that leaves platforms exposed during the critical hours between detection and confirmation. The FSC did not publish the full conditions attached to the letter, and that omission matters. Absent published thresholds, exchanges will decide for themselves what counts as suspicion, at least until the regulator clarifies the boundaries.

What will exchanges have to change?

The FSC paired the suspension authority with a broader set of operational demands. The regulator called for:

• Round-the-clock monitoring and incident response capability
• Higher cold-wallet holdings relative to customer assets
• Stronger insurance coverage and reserve buffers

Exchanges that cannot staff continuous monitoring will face a constraint: they may process deposits and withdrawals only during staffed hours, and they must notify users in advance. That condition effectively converts 24/7 trading — the baseline expectation of crypto markets — into a privilege earned through staffing. Smaller platforms with thin operations budgets will feel this rule first, though the FSC has not quantified how many venues meet the monitoring standard today.

Why now? Two incidents and a failed audit

The policy follows two security episodes at South Korean exchanges within a single week. On Friday, GOPAX suspended trading, deposits and standard withdrawals after receiving a hacking threat; a company representative said no breach had occurred. The suspension was precautionary — precisely the kind of action that sits in a legal gray zone under current rules, which the no-action letter now addresses.

Three days earlier, on Oct. 24, trading platform Prabang halted services after detecting abnormal hot-wallet withdrawals. The platform reported roughly $70,000 in losses — a small sum by historical exchange-breach standards, roughly the value of three mid-sized Seoul apartments' annual maintenance fees, but a signal that hot-wallet controls failed at a licensed venue.

The FSC's own audit results give the policy its harder edge. In October, the regulator found cybersecurity deficiencies at 130 of 555 financial companies reviewed nationwide — a failure rate of roughly 23 percent, or nearly one in four firms examined. It separately named GOPAX operator Streami and Prabang among 16 companies tied to earlier security incidents. In plain terms: the regulator already knew where the weaknesses were before this month's incidents made them public.

What happens next?

The no-action letter takes effect as an enforcement-guidance instrument rather than legislation, which means its durability depends on the FSC's continued position rather than statute. Exchanges must now build the monitoring, insurance and reserve posture the regulator demands, or accept constrained operating hours. Whether the FSC publishes the suspension conditions — and whether lawmakers formalize them in the pending crypto legislation, including the separate debate over delaying the crypto tax to 2029 — will determine if this becomes a durable market-structure change or a temporary supervisory patch.