South Korea's FSC to Let Exchanges Freeze Withdrawals on Suspected Hacks

South Korea's Financial Services Commission will issue a no-action letter allowing cryptocurrency exchanges to temporarily block deposits and withdrawals when they suspect a hacking attempt, according to a Thursday announcement. The decision, made after a security meeting chaired by FSC Vice Chairman Shin Jin-chang in Seoul, marks a shift from the current standard, which permits suspensions only after an incident is clearly established. Preventive freezing, in plain words, is now sanctioned — but only under specified conditions.

Why is the regulator acting now?

The move follows a string of security incidents at South Korean platforms. On November 6, GOPAX suspended trading, deposits and standard withdrawals after receiving an email threatening a cyberattack. The exchange moved customer assets into cold wallets during its investigation. GOPAX stated it had detected no actual hack or theft; withdrawals remained possible through manual verification via support channels.

On October 24, Prabang, another South Korean exchange, halted operations after detecting abnormal withdrawals from its hot wallet. The platform reported losses of approximately $70,000 — a modest sum by breach standards, roughly what a mid-sized firm might lose to a single ransomware incident — and said it would compensate affected customers from company funds. Each incident exposed the same gap: exchanges hesitated to act before confirming an attack, because the existing Virtual Asset User Protection Act requires legitimate grounds for restricting customer funds.

The FSC argues rapid intervention prevents further losses when a breach is plausible. That promise carries a caveat; the letter provides regulatory assurance, not unrestricted authority to freeze customer funds.

What do the new security requirements demand?

The FSC's guidance extends beyond withdrawal rules. It compels operational changes:

• Continuous monitoring. Exchanges must monitor systems around the clock, matching the market's 24-hour schedule, with responsible personnel available to investigate suspicious transactions.
• Restricted operating hours. Platforms unable to maintain round-the-clock supervision may process deposits and withdrawals only when security teams are on duty. Customers must be informed in advance, and staffing must handle withdrawal requests promptly.
• Tighter custody. Operators should keep more assets offline, limit hot-wallet balances to routine transaction needs, and consider spreading funds across multiple wallets.
• Insurance and reserves. Exchanges must maintain sufficient coverage and financial reserves to compensate customers affected by hacking incidents.

South Korea already requires virtual asset service providers to hold at least 80% of customer cryptocurrency in cold storage. The FSC says the industry's aggregate cold-wallet ratio exceeds 95%, though individual exchanges vary considerably. Authorities weighed tighter storage rules after Binance's October breach, according to earlier reporting.

At the November 12 meeting, Shin said virtual asset companies should maintain security standards comparable to traditional financial institutions because they store and manage customer assets. The equivalence argument is straightforward; whether smaller exchanges can staff it is the open question.

What comes next?

The FSC intends to introduce further cybersecurity obligations through its proposed Digital Assets Act. The legislation would require cryptocurrency businesses to meet IT security standards and assume liability for damages on par with financial institutions. The regulator also wants prompt reporting of suspected breaches and unusual external access attempts.

The Financial Security Institute will expand support for crypto businesses, including threat intelligence, vulnerability assessments and specialist training. Only five won-market exchanges among 28 registered virtual asset service providers currently participate — under one in five, by any count. The FSC plans to encourage memberships while offering alternative support to operators that cannot join.

The institute will update its security inspection standards by the end of 2026, covering transaction verification, wallet access controls, blockchain systems and smart contracts. Until then, the no-action letter defines what exchanges may do on suspicion alone — and customers will learn in practice where preventive protection ends and frozen funds begin.