South Korea's Financial Services Commission (FSC) has issued guidance allowing crypto exchanges to freeze customer deposits and withdrawals when a hack is suspected, rather than waiting for confirmation of a breach. The shift aims to protect investors from rapid theft but creates uncertainty about when assets can be accessed.
Under South Korea's crypto investor-protection law, exchanges are generally prohibited from blocking withdrawals without legitimate grounds. The FSC addressed this ambiguity by issuing a no-action letter, a written pledge not to penalize exchanges that halt transactions in response to suspicious activity.
Regulatory Response to Recent Breaches
The policy change follows several high-profile incidents. In late October, attackers drained approximately $6.3 billion from Binance, a theft the FBI attributed to North Korea. Domestically, Bithumb disclosed a personal data leak from an internal mobile system in late October, while GOPAX halted trading and withdrawals on November 6 following a hacking threat.
Cybersecurity Oversight Challenged
The FSC also wants all 28 registered crypto businesses to join the Financial Security Institute (FSI), the sector's state-run cyber auditor. Currently, only five won-trading exchanges belong to the FSI. The agency plans to require the remaining 23 to join or receive similar security support, including vulnerability assessments.
This push faces timing challenges. The FSI confirmed on Monday that hackers had compromised its online portal used by financial firms to submit security-audit paperwork. The FSI said the portal operates outside its core network and regulators are investigating what files were accessed, which may include companies' responses to FSI security assessments.
Enhanced Reserve Requirements
New guidelines also direct exchanges to maintain minimal balances in hot wallets and to increase insurance and reserves. Operators already hold over 95% of client assets offline, exceeding an 80% legal floor.
Permanent rules depend on the proposed Digital Asset Act, which would impose bank-grade IT requirements and damage liability on exchanges. Until legislation passes, Seoul continues regulating by guideline while its security partner investigates its own breach.
