South Korea's Financial Services Commission announced Thursday that it will issue a no-action letter allowing crypto exchanges to suspend deposits and withdrawals when hacking is suspected, without waiting for a breach to be confirmed. A no-action letter is a regulator's written promise not to penalize a specific behavior.
The policy shift moves the trigger point from confirmed breach to suspected breach, addressing a critical timing challenge for platforms that often have only minutes to respond to attacks.
Recent incidents prompt policy change
Two incidents appear to have prompted the decision. On November 6, exchange GOPAX suspended operations after receiving a threatening email and moved assets into cold storage despite no confirmed breach. Earlier, on October 24, platform Prabang lost approximately 100 million won, or about $70,000, from its internet-connected hot wallet used for everyday withdrawals. Prabang pledged to compensate affected customers using company funds.
These cases reflect a broader pattern. Between late September and early November, more than 37 financial firms in South Korea experienced cyber incidents, resulting in approximately 473,000 exposed records and roughly 1 billion won stolen from hot wallets and other targets.
Broader security measures under review
The FSC held an emergency meeting on November 2 as attacks escalated and has since urged exchanges to strengthen security protocols. A key measure involves cold storage, the offline wallets that are much harder to access remotely. Exchanges must currently keep at least 80% of assets in cold wallets, and the FSC has called for raising that minimum.
Tougher asset management rules, including higher cold-storage requirements, could affect liquidity and operational flexibility. Holding more assets offline means processing large withdrawals can take longer.
Key details remain unclear, including how the regulator will define suspected hacking and how long a freeze can last. The extent of any new cold-storage minimum above the current 80% threshold is also yet to be determined.
