Regulatory Changes for Faster Response to Threats

The Financial Services Commission issued a no-action letter on Thursday permitting exchanges to impose preventive suspensions on customer deposits and withdrawals when indicators of a cyberattack appear. This framework addresses the limitations in current rules, which previously required clear evidence of a hacking incident before any restrictions could take effect.

Exchanges must now maintain 24/7 security monitoring and incident response capabilities. Those unable to sustain continuous operation are required to process transactions only during staffed hours and notify users in advance. The commission also mandates higher cold-wallet storage for customer assets, increased insurance coverage, and stronger risk management protocols.

Security Incidents Driving Regulatory Action

Recent events at South Korean cryptocurrency exchanges prompted the update. GOPAX suspended trading, deposits, and withdrawals following a hacking threat, though no breach was confirmed. The platform began transferring assets to cold storage while customers requested withdrawals through support channels with manual verification.

Trading platform Prabang halted operations after detecting abnormal withdrawals from its hot wallet, reporting losses of approximately $70,000. The commission had earlier identified cybersecurity deficiencies at 130 of 555 financial entities reviewed, naming the operators of GOPAX and Prabang among 16 companies previously affected by security issues.

Enhanced Security and Inspection Requirements

South Korea currently requires virtual asset service providers to store at least 80 percent of customer cryptocurrency in cold wallets, with the industry average exceeding 95 percent. The commission wants exchanges to limit hot-wallet balances to levels needed for routine operations and consider distributing funds across multiple wallets.

The Financial Security Institute will expand its support for virtual asset providers through additional inspections of wallets, blockchain infrastructure, and transaction controls. Updates to security standards are scheduled for completion by the end of 2026. The institute plans to offer threat intelligence, vulnerability assessments, and specialist training, while encouraging voluntary membership and providing alternatives for operators unable to join.

Implications for Exchanges and Users

Exchanges gain clearer regulatory assurance when implementing preventive measures, reducing uncertainty around service interruptions. Users may experience more frequent or predictable pauses in withdrawals, particularly at platforms without round-the-clock staffing, though advance notifications are required in those cases.

The commission's move forms part of wider efforts to align cryptocurrency security standards with those of traditional financial institutions. Additional obligations will be introduced through proposed legislation, including requirements for IT security measures and liability comparable to conventional banks.