South Korea to Let Crypto Exchanges Freeze Withdrawals on Suspected Hacks
Key Takeaways
- •South Korea's Financial Services Commission will issue a no-action letter permitting crypto exchanges to suspend deposits and withdrawals when a hack is merely suspected, before any breach is confirmed.
- •Current rules allow exchanges to restrict withdrawals only after a hacking incident has been clearly established, leaving no room for preventive action based on suspicion alone.
- •The regulator also called for 24/7 monitoring and incident response, higher cold-wallet holdings, and stronger insurance coverage and reserves, with exchanges unable to monitor continuously limited to staffed-hour processing and advance user notification.
- •The policy shift follows recent security events, including GOPAX's precautionary suspension of services after a hacking threat and a roughly $70,000 hot-wallet breach at Prabang on Oct. 24.
- •An October FSC review identified cybersecurity deficiencies at 130 of 555 financial companies, and the specific conditions in the no-action letter will determine when preventive suspensions can be applied in practice.
South Korea to Let Crypto Exchanges Freeze Withdrawals on Suspected Hacks
South Korea's Financial Services Commission (FSC), the country's top financial regulator, will allow crypto exchanges to suspend deposits and withdrawals as soon as a hack is suspected, rather than waiting until a breach is confirmed, amid a broader push for stronger security across the industry.
On Thursday, the FSC said it would issue a no-action letter permitting preventive suspensions under certain conditions, laying out the plan in an official notice. Current rules prohibit exchanges from blocking withdrawals without legitimate grounds and explicitly allow restrictions only when a hacking incident has been clearly established — a threshold that leaves no room for preventive action based on suspicion alone.
The regulator also called for round-the-clock monitoring and incident response, higher cold-wallet holdings, and stronger insurance coverage and reserves. Cold wallets store private keys offline and are widely regarded as harder for remote attackers to reach than internet-connected hot wallets. Exchanges unable to monitor continuously would process deposits and withdrawals only during staffed hours and must notify users in advance.
The shift follows recent security incidents at South Korean crypto platforms, including a precautionary service suspension at GOPAX and a roughly $70,000 hot-wallet breach at Prabang. On Friday, crypto exchange GOPAX suspended trading, deposits and standard withdrawals after receiving a hacking threat, although a representative said no breach had occurred. On Oct. 24, trading platform Prabang halted services after detecting abnormal hot-wallet withdrawals, reporting losses of about $70,000.
The announcement builds on a wider cybersecurity review. In October, the FSC identified cybersecurity deficiencies at 130 of 555 financial companies examined nationwide, and separately listed GOPAX operator Streami and Prabang among 16 companies involved in earlier security incidents. The specific conditions attached to the no-action letter will determine when exchanges can apply preventive suspensions in practice.
