South Korea is preparing to give cryptocurrency exchanges greater leeway to halt customer transactions when a suspected hack could turn into an actual loss. The Financial Services Commission (FSC) said on Nov. 12 that it plans to issue regulatory guidance allowing exchanges to suspend deposits and withdrawals when abnormal activity points to a possible security breach.

The plan, outlined in an announcement published on the FSC's website, forms part of a broader effort to bring the country's crypto security standards in line with those applied to traditional financial institutions.

Freezing Transfers Before a Hack Is Confirmed

Under the Virtual Asset User Protection Act, which took effect in July 2024, platforms cannot restrict deposits or withdrawals without a legitimate reason. A suspension is warranted once a hacking incident is confirmed, but the rules had left unresolved what exchanges may do when suspicious activity emerges before a breach is verified.

The FSC now intends to fill that gap. The regulator will issue a no-action position permitting preventive restrictions whenever there is reason to believe hacking or unauthorized access has occurred. Such a position signals that the commission does not intend to pursue enforcement action against exchanges that halt services on these grounds. The aim is for platforms to react quickly enough to minimize customer losses rather than wait until an intrusion is well under way.

The strategy comes amid recent security threats in South Korea's crypto sector. On Nov. 6, GOPAX, a South Korean virtual asset exchange, announced a hacker attack threat, with deposits, withdrawals and trading suspended. The episode underscored the uncertainty operators have faced when weighing responses to suspicious activity before any breach is confirmed.

24/7 Monitoring and Hot-Wallet Controls

The FSC also wants exchanges to operate continuous monitoring adapted to crypto's round-the-clock trading environment. Platforms should maintain staff capable of identifying abnormal transactions and applying effective controls without delay. Exchanges that cannot sustain continuous monitoring should process deposits and withdrawals only during periods when sufficient security personnel are on duty.

The South Korean government has already been pushing virtual asset service providers (VASPs) to keep at least 80% of customers' virtual assets in cold wallets, offline storage that is not connected to the internet. According to the FSC, the industry's cold-storage ratio already exceeds 95%, and operators should keep their hot-wallet holdings — the internet-connected wallets used to process day-to-day transfers — no larger than necessary for ordinary business operations.

The regulator additionally advised exchanges to spread hot wallet funds across more than one wallet, a practice that limits how much is exposed should any single wallet be compromised, and to maintain adequate insurance and reserves to compensate users in the event of a breach.

Expanded Security Checks

The plan also foresees greater involvement of the Financial Security Institute. The FSC said only five exchanges among 28 virtual asset service providers have joined the institute and won its approval, leaving the majority of the country's VASPs outside its review framework to date. Operators are now seeking to take part, and authorities plan to extend threat intelligence, vulnerability assessments and cybersecurity training to more of them.

The institute is also expected to strengthen criteria for transaction checks, wallet access security, and the integrity of blockchains and smart contracts.

In parallel, the FSC is developing more comprehensive digital finance legislation that would impose cybersecurity requirements on virtual asset providers similar to those applied under banking regulations. Regulators also want suspected breaches and abnormal external access attempts to be reported promptly to financial authorities. The work advances on two tracks: near-term regulatory guidance enabling preventive freezes, and longer-term legislation that would anchor cybersecurity obligations for virtual asset providers in a banking-style framework.