South Korea’s Financial Services Commission (FSC) held its second AI-related emergency meeting of the week after the KOSPI plunged 7.57% on Thursday, while regulators also investigated an exploit campaign that breached 16 financial firms, including the Gopax crypto exchange.

The cyberattack campaign was linked to hackers who used AI tools, adding to concerns about the risks posed by artificial intelligence across the country’s financial sector. Taken together, the two episodes—one driven by AI spending concerns in equities, the other by AI-assisted intrusions—have pushed artificial intelligence to the center of Korea’s financial policy agenda.

AI spending concerns fuel KOSPI sell-off

The KOSPI closed Thursday at 5,554.22, down 7.57%, after falling as much as 8% during the October 15 session. The decline triggered the exchange’s 20-minute trading halt, which acts as a circuit breaker, for the first time in about two and a half months.

Samsung Electronics fell 9.70%, while SK Hynix dropped 11.35%. Foreign investors sold a net 2.9 trillion won ($2.15 billion) in shares. The steep losses in Korea’s two flagship chipmakers show how closely the index is tied to sentiment around AI infrastructure spending.

“The market is reacting sensitively to whether capital raising will be sustainable and whether massive infrastructure investment will lead to real income, rather than revenue growth itself in AI services,” Seo Sang-young, an analyst at Mirae Asset Securities, told Reuters. He said questions surrounding the broader AI trade unsettled investors even more than chip earnings.

The decline prompted FSC Chairman Lee Eok-won to convene an emergency review of the stock market. The meeting included the Financial Supervisory Service (FSS) and the Korea Exchange. Participants concluded that the sell-off had gone too far, citing solid earnings from the semiconductor, defense and shipbuilding sectors.

The regulators also reaffirmed a zero-tolerance stance toward market manipulation and illegal short selling, pairing reassurance on fundamentals with an enforcement warning.

The sell-off followed unease after Broadcom CEO Hock Tan spoke at an event in Singapore on October 12. Tan compared AI investors with casino gamblers, according to Cryptopolitan.

FSC responds to AI-linked attacks on financial firms

Earlier in the week, the FSC held an emergency meeting after regulators confirmed breaches at 16 financial firms, including Korean banks and crypto exchanges operated by Streami—Gopax—and Prabang. Cryptopolitan reported on the attacks. The mix of targets underlined that AI-enabled intrusions reach beyond conventional banking into the digital-asset industry.

South Korean President Lee Jae Myung ordered a full review October 4. Local reports quoted him as saying, “In some hacking incidents, signs have emerged of AI being used, causing considerable public concern and anxiety.”

FSC expands AI security measures

The FSC had already taken steps to address AI-related cyber threats. In July, it distributed the “Frontier AI Security Threat Response Guidelines for the Financial Sector,” which were designed to help firms respond to threats from frontier AI models such as Anthropic’s Mythos.

That month, the FSC’s Immunity Review Committee also cleared firms of liability for IT outages that occurred during AI security testing and patching.

The regulator is now adding several measures. It will map every system connected to external networks, require large firms to conduct vulnerability checks at least twice a year, and clarify accountability between chief executives and security officers. It will also assess whether smaller companies can use an AI-based joint monitoring system. Completion of the network mapping, the first rounds of semiannual vulnerability checks and a decision on extending joint monitoring to smaller firms are the concrete markers to watch as the measures move from announcement to implementation.

The review identified security gaps at financial firms. Of the 555 companies surveyed, 130, or 23.4%, reported shortcomings including missing patches and aging systems. The figures set a baseline for judging whether the new requirements close those gaps.

“It is deeply painful that basic requirements were found not to have been properly observed,” FSC Secretary General Shin Jin-chang said. He added that network-separation rules would be eased so financial firms can use AI to defend against AI-based attacks. The change signals a pragmatic turn for a rulebook built around keeping critical systems isolated, and it frames AI as both a threat to be guarded against and a tool to be deployed in the sector’s own defense.