On November 12, 2026, South Korea’s Financial Services Commission announced plans to issue a no-action letter allowing cryptocurrency exchanges to freeze deposits and withdrawals upon suspected hacking before breach confirmation. The regulatory shift follows a November 6 extortion threat against GOPAX and an October 24 hot-wallet breach at Prabang that stole $70,000. Regulators are also pushing platforms to raise cold-storage ratios above 80% and enforce round-the-clock monitoring.
New regulatory policy for emergency withdrawal freezes
- ▪South Korea's Financial Services Commission announced on November 12, 2026, a no-action letter providing regulatory relief and legal protection from penalties for cryptocurrency exchanges suspending deposits and withdrawals upon suspected hacking prior to breach confirmation
- ▪South Korea's existing regulations prohibit cryptocurrency platforms from blocking user withdrawals without clear confirmation of a completed security breach
New operational and security requirements for exchanges
- ▪The Financial Services Commission mandated that cryptocurrency exchanges lacking continuous security monitoring capability must restrict deposit and withdrawal processing exclusively to staffed operating hours
- ▪The Financial Services Commission requested cryptocurrency exchanges increase cold-wallet asset storage above the mandated 80% minimum, mandate round-the-clock security monitoring, and enhance insurance coverage
Recent security incidents and audit findings
- ▪The cryptocurrency trading platform Prabang lost approximately 100 million won ($70,000) from its hot wallet during an October 24, 2026 security breach and pledged company funds for customer compensation
- ▪Between late September and early November 2026, cyber incidents targeted over 37 South Korean financial firms, exposing 473,000 records and resulting in 1 billion won stolen from hot wallets
- ▪South Korean cryptocurrency exchange GOPAX preemptively suspended services and moved digital assets into cold storage on November 6, 2026, after receiving a hacking threat without a confirmed breach
- ▪In October 2026, the Financial Services Commission audited 555 nationwide financial companies, identifying cybersecurity deficiencies at 130 firms and past security incidents at 16 companies including GOPAX operator Streami and Prabang
Story comments
Loading comments…