South Korean President Lee Jae Myung has directed officials to study the creation of a single, powerful agency to lead the country's cybersecurity efforts, following a record-breaking crypto theft at Binance and a series of hacks targeting domestic financial firms.

Lee's proposal for a cybersecurity 'tsar' body

Speaking at a cabinet meeting held at the Blue House, President Lee said the current approach — completing security checks and addressing problems only after an attack has occurred — is not working well enough. He asked officials to “actively consider forming a powerful and effective cybersecurity ‘tsar’ body” that would lead and organize security work currently spread across many government offices.

Lee also said the country should consider a task force that brings together both government and private companies. He noted that artificial intelligence is making hacking smarter and more common, and said the objective should be to stop attacks before they happen. He identified finance, energy and information networks as key sectors requiring stronger protection.

The precise structure of the proposed agency, and which powers it would take over from existing offices, has yet to be decided. The emergency checks by the National Intelligence Service and the Financial Services Commission's review of crypto exchanges provide immediate measures while officials consider whether a broader centralized cybersecurity framework is needed.

Why cybersecurity is now a priority in Seoul

The main trigger for the president's request was the October 29 theft at Binance, in which a hacker drained approximately $6.3 billion from the exchange's internet-connected “hot” wallets across ten blockchains — most of it in about 20 minutes. Blockchain analytics firm TRM says it is the largest crypto theft ever, about four times the $1.5 billion Bybit hack in February 2025.

The FBI blamed North Korea for the attack on October 31, and TRM linked it to a North Korean hacking unit called TraderTraitor. North Korea has so far denied the attribution: Kim Yo Jong, the sister of leader Kim Jong Un, dismissed the claim as “absurd rhetoric and nothing new,” Cryptopolitan reported.

The Binance incident is not the only concern. Several Korean financial firms have been hacked recently, including Mirae Asset Global Investments, crypto exchange Bithumb and Daishin Securities (KRX: 003540), with some of these attacks exposing customer data. In response, South Korea's spy agency, the National Intelligence Service, has started emergency security checks at more than 2,100 ministries, local governments and public offices.

The Financial Services Commission has also called in staff from five Korean crypto exchanges — Upbit, Bithumb, Coinone, DigitalX and Gopax — to assess how ready they are following the Binance hack, Cryptopolitan reported.

Regulatory gaps for Korean users

Under Korean law, domestic exchanges must keep at least 80% of customer crypto in offline “cold” wallets. The Binance funds, by contrast, were stolen from hot wallets, which are connected to the internet.

Korean crypto users may nonetheless have less protection than Binance users: legislation covering the repayment of users after hacks, the Digital Asset Basic Act, has not yet passed.

Meanwhile, Binance has restored services and covered the losses from the incident, saying it funded about 95% of the stolen amount from its own reserves.