South Korea's crypto exchanges could soon be permitted to suspend deposits and withdrawals when they suspect a hack, even before a breach is confirmed. The Financial Services Commission (FSC) announced the plan on Nov. 12 after a meeting on digital asset security in Seoul, saying it intends to issue a no-action letter covering preventive suspensions under certain conditions.

The change would give platforms room to act before confirming a breach. The regulator also called for continuous monitoring and stronger protection of customer assets. The announcement follows a recent hacking threat against GOPAX and a separate incident at Prabang. The FSC has not said when it will issue the letter.

Why Crypto Exchanges May Suspend Customer Withdrawals

The Virtual Asset User Protection Act, South Korea's framework for protecting users of virtual asset services, prohibits platforms from blocking deposits and withdrawals without legitimate grounds. According to the FSC, a confirmed hacking incident can justify a suspension.

Exchanges told regulators, however, that they were unsure whether they could act before confirming a hack, since suspicious transactions can raise concerns before an attack has been established. A no-action letter provides regulatory assurance against enforcement for specified conduct under stated conditions. The FSC said it would use one to address the uncertainty around preventive suspensions.

The agency did not detail the qualifying conditions, an issue date, or a time limit for withdrawal freezes. Its announcement addressed deposits and withdrawals, but it did not say whether the planned letter would also cover trading suspensions.

A halt could prevent further unauthorized transfers while a platform investigates suspicious activity. It could also leave customers unable to withdraw assets during a volatile market. For that reason, the criteria for restarting withdrawals will matter to users who need access to their funds.

The FSC separately told crypto exchanges to report breaches or suspicious external access attempts promptly to financial authorities. It also called for staff to monitor unusual transactions and respond around the clock.

Platforms unable to maintain continuous monitoring should process deposits and withdrawals only when their response systems operate normally. They should notify customers of those hours in advance and have enough staff on hand to handle requests promptly.

GOPAX Threat Puts Exchange Security Measures in Focus

GOPAX suspended trading, deposits and regular withdrawals on Nov. 6 after receiving an email claiming the exchange had been hacked. The platform said it had not verified the threat and reported no loss of customer assets at the time. GOPAX began moving most assets held in online hot wallets into offline cold wallets, while customers could still request withdrawals through support channels, subject to manual verification.

Prabang also suspended its services after detecting abnormal withdrawals from its hot wallet on Oct. 24. The exchange reported losses of approximately $70,000 and said it would compensate affected customers with company funds.

The two cases show the range of triggers exchanges can face when weighing a preventive suspension: an unverified claim at GOPAX and confirmed abnormal withdrawals at Prabang.

The two incidents followed a broader review of financial firms. In October, 130 of 555 companies reported areas needing improvement in their cybersecurity controls, according to the FSC. A separate investigation identified incidents at 16 firms, including GOPAX operator Streami and Prabang.

Cold Storage, Insurance and Industry Oversight

The regulator wants crypto exchanges to keep more customer assets in cold wallets, which are not connected to the internet. South Korean rules already require operators to hold at least 80% of customer crypto offline, and the FSC said the overall share across operators stands at 95% or higher.

The FSC also urged platforms to hold only the amounts needed for trading in hot wallets, to consider spreading those assets across multiple wallets, and to maintain enough insurance and reserves to compensate customers after an attack, the kind of backstop Prabang drew on when it pledged to cover affected customers with company funds.

The agency plans to bring more crypto exchanges and other service providers into the Financial Security Institute, which provides threat information and security checks for its members. Only five of South Korea's 28 virtual asset businesses had joined so far, the regulator said. Its updated inspection standards will cover wallet access controls, transaction checks and smart contracts.

Source: Blockonomi — South Korea Crypto Exchanges May Freeze Withdrawals on Hack Fears · FSC notice