South Korea's FSC to Let Exchanges Freeze Deposits on Suspected Hacks

South Korea's Financial Services Commission (FSC) plans to issue a no-action letter that would let crypto exchanges suspend deposits and withdrawals the moment they suspect a hack — before any breach is confirmed.

Current rules generally bar exchanges from blocking withdrawals without legitimate grounds. Under the existing framework, hacking-related withdrawal restrictions are allowed only after an incident is clearly established. The proposed letter changes that sequencing, giving platforms a preventive option at the first sign of compromise.

The no-action letter sits inside a broader security package. The FSC also called for:

• round-the-clock monitoring and incident-response capacity;
• larger cold-wallet balances;
• stronger insurance coverage and reserve safeguards.

Platforms that can't run 24-hour monitoring would handle deposits and withdrawals only while staff are on duty, and would have to give users advance notice of those limited service windows.

Why is the FSC acting now?

The plan follows a string of security incidents at South Korean exchanges. GOPAX suspended trading, deposits and standard withdrawals on Friday, Nov. 6, after receiving a hacking threat. A company representative said no breach had occurred — meaning the platform halted services on suspicion alone, precisely the kind of preventive action the current rulebook doesn't clearly authorize.

Two weeks earlier, on Oct. 24, Prabang suspended services after detecting abnormal hot-wallet withdrawals. The platform put its losses at roughly $70,000.

The FSC had already been reviewing exchange access and withdrawal controls after a Binance hot-wallet breach that affected about $6.3 billion in token assets.

What does the no-action letter change in practice?

For exchanges, the shift is operational, not cosmetic. Today, a platform that freezes withdrawals on a hunch risks regulatory blowback if no breach materializes. If the letter issues as planned, suspension becomes a sanctioned first move, and the compliance question flips: platforms will need defensible suspicion procedures, documented triggers and clear user communications rather than post-incident justifications.

The 24-hour monitoring requirement carries its own cost structure. Smaller platforms that can't staff round-the-clock operations will face a de facto service downgrade — deposits and withdrawals only during working hours, with advance notice — which puts them at a competitive disadvantage against larger exchanges that already run always-on security teams.

Higher cold-wallet minimums and stronger insurance and reserve requirements add capital and procurement burdens on top. Together, the package pushes South Korea's exchange market toward the operational posture of a licensed financial institution: continuous surveillance, ring-fenced custody and pre-funded loss absorption.

For users, the trade-off is straightforward. Faster suspensions should limit the window in which an attacker can drain hot wallets, as Prabang's $70,000 incident illustrates. The cost is more frequent — and legally safer — service interruptions like GOPAX's Nov. 6 shutdown, including in cases where no breach is ultimately found.

The FSC has not announced an issuance date for the no-action letter, so exchanges are watching for the formal publication that would convert preventive suspensions from a regulatory risk into an authorized response.