South Korean regulators are considering significantly increasing the amount of customer assets that crypto exchanges must hold in cold storage, according to reports. The move follows last week's Binance security breach, which has been described as the most devastating attack in crypto history.
Cold Storage Rule Under Review
The Financial Services Commission held an emergency security meeting with major virtual asset exchanges and custody firms to examine ways to strengthen asset protection. Under the existing Virtual Asset User Protection Act, exchanges must keep at least 80% of customer assets in cold wallets, which are disconnected from the internet. The remaining portion can be held in hot wallets to facilitate withdrawals and other transactions.
Regulators are now discussing whether to raise the minimum closer to 99%, a level already maintained by some major platforms.
Potential Challenges for Smaller Exchanges
The proposed change could create major challenges, particularly for smaller exchanges that may lack the operational capacity of larger competitors. While cold wallets offer stronger protection against online attacks, accessing funds stored in them involves additional approval and signing procedures. This means exchanges could have less money readily available to process customer withdrawals.
The concern extends beyond inconvenience. In a market where crypto prices are highly volatile, delayed withdrawals could prevent investors from moving their holdings when they need to sell or transfer them. If an asset is rapidly losing value, waiting for funds to be released from offline storage could leave investors exposed to further losses.
There is already an example of how this can happen. Bithumb experienced withdrawal delays of approximately 13 hours for certain altcoins in August after insufficient hot wallet balances forced the exchange to move additional assets from cold storage.
Weak Links Behind the Heist
More than $6.3 billion in cryptocurrency was stolen in the Binance breach, which the FBI has attributed to the North Korea-linked hacking group TraderTraitor. Pyongyang has denied responsibility. Kim Yo Jong, department director of the Central Committee of North Korea's Workers' Party, dismissed Washington's allegations as politically motivated.
The incident has also prompted scrutiny of how exchanges secure their internal systems. CoinEx founder Haipo Yang identified three security weaknesses at Binance that he believes could have been avoided. First, he said the exchange had not properly isolated its development and operations environments. Employees with access to production systems should use dedicated machines, with coding, messaging, and web browsing kept on separate devices.
His second concern was the lack of meaningful two-factor authentication for production access. Yang said a single compromised key was enough to give an attacker access to live systems. He suggested using AWS Session Manager with hardware security keys to ensure that one stolen credential would not be sufficient.
Questions were also raised about Binance's multisignature security setup. Yang pointed out that the different parties involved in approving transactions were not independently verifying them. He said this defeated the purpose of having multiple signers, as compromising one node could put the entire system at risk.
