South Korea’s Financial Services Commission (FSC) said on November 12, 2026, that it plans to issue a “no-action letter” allowing cryptocurrency exchanges to preemptively freeze deposits and withdrawals when a hack is suspected, even before a breach is confirmed. The letter had not been issued as of the announcement, and its conditions had not been published.

According to the FSC announcement, the planned letter would be a written regulatory commitment not to penalize exchanges that suspend transactions under defined conditions after detecting signs of a potential attack. The proposed guidance would therefore shift the trigger for intervention from a confirmed breach to reasonable suspicion.

The policy proposal comes amid a rise in attacks against South Korean financial infrastructure. According to CryptoBriefing, more than 37 financial firms were affected by cyber incidents between late September and early November 2026. The incidents exposed approximately 473,000 records and resulted in roughly 1 billion won, or about $700,000, in stolen funds. The report said the FSC convened an emergency meeting on November 2 as the volume of attacks increased.

Two recent incidents highlighted the difficulty exchanges face under the previous rules, illustrating both the legal risk of acting on suspicion and the financial cost of waiting for confirmation. GOPAX, operated by Streami, suspended operations on November 6 after receiving a threatening email and moved assets to cold storage, although no breach had been confirmed. Acting on suspicion alone placed GOPAX in a legal grey area and potentially exposed the exchange to regulatory penalties.

An earlier incident involving South Korean exchange Prabang demonstrated the potential cost of delaying action. According to KuCoin, Prabang halted services on October 24 after detecting abnormal withdrawals from a hot wallet. Approximately $70,000, or roughly 100 million won, was lost before the platform could respond. Prabang reportedly pledged to compensate affected customers with company funds.

FSC audit identifies security gaps

The FSC said a sector-wide security audit of 555 financial companies nationwide found cybersecurity deficiencies at 130 of them, representing a failure rate of roughly 23% among the companies reviewed.

FSC Vice Chairman Shin Jin-chang chaired the virtual-asset industry security meeting that produced the planned guidance, according to the commission. The FSC said it is requiring all exchanges to maintain monitoring and staffing around the clock.

The commission is also seeking to expand participation in the Korea Financial Security Institute. Only five of South Korea’s 28 virtual asset service providers are currently members, leaving 23 firms without access to services such as vulnerability assessments, white-hat penetration testing and 24-hour incident response. The FSC is urging the remaining providers to join. As of the announcement, however, most of the domestic crypto industry remained outside that institutional security framework.

India Crypto Research noted on X that regulators could not order compensation after the Upbit hack under the rules then in force. The FSC has since been working toward no-fault liability under which exchanges would be required to compensate users for losses caused by hacks or outages, similar to the obligations imposed on banks. The planned no-action letter is therefore part of a broader effort in Seoul to establish clearer exchange accountability.

Cold-wallet requirements create operational tradeoffs

Under the FSC’s announced policy, exchanges must hold at least 80% of customer assets in cold wallets, and the commission is seeking to raise that minimum. Keeping a larger share of assets offline can reduce exposure to hot-wallet attacks such as the one involving Prabang. It can also create an operational tradeoff: larger legitimate withdrawal requests may require assets to be moved manually from cold wallets to hot wallets, potentially slowing processing during periods of high demand.

The FSC’s current guidance does not address that tradeoff, and regulators have not publicly specified how they would balance higher cold-storage requirements with users’ expectations for withdrawal speed. The details of the no-action letter also remain unresolved, including the conditions that would qualify as “reasonable suspicion,” the maximum period for a permitted freeze and any user-notification requirements. Until those terms are published, neither the length of a permitted freeze nor the notification users would receive is defined.

Digital Asset Basic Act would establish broader liability

The FSC said it plans to include provisions in the forthcoming Digital Asset Basic Act requiring virtual asset service providers to meet stability standards equivalent to those in the financial industry and to assume liability for damage caused by hacks or operational failures.

If enacted, those provisions would move key exchange obligations from regulatory guidance into statutory law. That could reduce the need to rely on instruments such as no-action letters to address future regulatory gaps. Enforcement remains a challenge, however. With 23 of 28 virtual asset service providers still outside the Financial Security Institute, the FSC’s ability to verify compliance with 24-hour monitoring requirements and cold-wallet ratios is limited by the same institutional coverage gap it is attempting to close.

South Korea has also experienced significant digital-asset security failures beyond the crypto-exchange sector. A separate incident involving South Korean prosecutors and Bitcoin illustrated the broader security risks faced by institutions handling digital assets.

If issued as announced, the no-action letter would remove a legal disincentive for exchanges to respond defensively to anomalies. For exchange operators and their liquidity-risk teams, the proposed change would create a written regulatory safe harbor for preemptive freezes. The central unresolved issue is the threshold for action: the specific criteria that would determine when suspicion is sufficient to justify suspending deposits and withdrawals. Until the FSC publishes those criteria, the safe harbor remains an announced plan rather than an operating rule.