South Korea plans to allow cryptocurrency exchanges to temporarily suspend customer deposits and withdrawals when they suspect a cyberattack, without waiting for confirmation that a breach has occurred. The Financial Services Commission (FSC) will issue a no-action letter permitting preventive restrictions under specified conditions. The proposed measures also call for round-the-clock security monitoring, greater use of cold wallets, stronger insurance coverage and additional financial reserves. The move follows recent security incidents involving local exchanges GOPAX and Prabang and forms part of a wider effort to bring cryptocurrency businesses closer to the security standards expected of traditional financial institutions.
Key Takeaways
- South Korea’s Financial Services Commission announced the proposed measures on November 12, 2026.
- Exchanges will be allowed to suspend deposits and withdrawals when hacking or unauthorised access is suspected, subject to specified conditions.
- Platforms will be expected to maintain 24/7 security monitoring and incident response teams.
- Exchanges unable to provide continuous monitoring may have to restrict transactions to staffed operating hours and notify customers in advance.
- The regulator wants operators to minimise hot-wallet balances and strengthen insurance coverage and financial reserves.
- The measures follow security incidents involving GOPAX and Prabang, including reported losses of approximately $70,000 at Prabang.
Why Is South Korea Changing Its Crypto Withdrawal Rules?
South Korea is moving to give cryptocurrency exchanges greater flexibility to respond to suspected cyberattacks before customer funds are lost.
On November 12, 2026, the Financial Services Commission (FSC) announced plans to issue a no-action letter allowing exchanges to temporarily suspend customer deposits and withdrawals when they suspect hacking or unauthorised access.
The decision addresses uncertainty surrounding the country’s existing cryptocurrency regulations. Under the current Virtual Asset User Protection Act, exchanges cannot restrict customer deposits and withdrawals without legitimate grounds. Restrictions are permitted when a hacking incident has been clearly established.
However, this requirement has created a difficult situation for exchanges. A platform may detect unusual transactions, suspicious wallet activity or possible unauthorised access but still lack sufficient evidence to confirm that a cyberattack has occurred.
Waiting for confirmation could give attackers additional time to move customer assets out of compromised wallets.
The new guidance will remove uncertainty over whether exchanges can intervene when they detect suspicious activity but have yet to confirm an attack.
The proposed no-action letter is intended to provide regulatory assurance for preventive restrictions that meet specified conditions. It does not give exchanges unrestricted authority to freeze customer funds whenever they choose.
The regulator’s position is that early intervention can help prevent further losses while an exchange investigates a potential security incident.
What Is a No-Action Letter and How Will It Work?
A no-action letter is a form of regulatory guidance indicating that a regulator will not take enforcement action against specified conduct when the stated conditions are met.
In this case, South Korea’s FSC intends to use the letter to clarify when cryptocurrency exchanges can temporarily restrict deposits and withdrawals in response to suspected hacking incidents.
The distinction is important because the existing rules have focused on situations where a breach is already established. The proposed guidance would recognise that exchanges may need to act earlier, when suspicious activity indicates a possible attack.
For example, if an exchange detects unusual withdrawals from a hot wallet or signs of unauthorised access, it could temporarily suspend transactions while its security team investigates.
This could reduce the time available to attackers to move funds. However, it also creates a risk that legitimate customers could temporarily lose access to their assets even when no actual breach has occurred.
That makes the conditions attached to the no-action letter particularly important. The regulator will need to ensure that preventive suspensions are justified, proportionate and handled transparently.
The measures therefore represent a change in how exchanges can respond to security threats, rather than an unrestricted new power to block customer transactions.
What New Security Requirements Will Crypto Exchanges Face?
The FSC’s proposed changes extend beyond withdrawal restrictions. The regulator also wants cryptocurrency exchanges to improve their ability to detect, investigate and respond to cyber threats.
1. Round-the-clock security monitoring
Cryptocurrency markets operate continuously, unlike traditional financial markets that generally have defined trading hours. This creates a challenge for exchanges because suspicious activity can occur at any time.
The FSC has called for exchanges to maintain continuous security monitoring and incident response teams capable of investigating unusual transactions and responding quickly to potential attacks.
Platforms unable to provide continuous supervision will be expected to process deposits and withdrawals only during staffed hours and notify customers in advance.
This means exchanges that cannot maintain 24-hour monitoring may have to limit when customers can deposit or withdraw their cryptocurrency.
The regulator also expects affected platforms to have enough personnel available to handle withdrawal requests promptly during their operating hours.
2. Greater reliance on cold wallets
Another major part of the proposed framework concerns how exchanges store customer cryptocurrency.
Crypto exchanges commonly use two types of wallets:
- Cold wallets: These store cryptocurrency offline and are generally less exposed to internet-based attacks.
- Hot wallets: These remain connected to the internet, making them more convenient for routine transactions but potentially more vulnerable to cyberattacks.
South Korea currently requires virtual asset service providers to keep at least 80% of customer cryptocurrency in cold storage.
The FSC said the industry’s overall cold-wallet storage ratio already exceeds 95%, although individual exchanges maintain different proportions.
Despite this relatively high industry-wide figure, the regulator wants platforms to limit hot-wallet balances to the amounts needed for routine transactions.
Exchanges are also encouraged to consider distributing funds across multiple wallets rather than concentrating large amounts in a single location.
The objective is to reduce the amount of cryptocurrency that could be exposed if an internet-connected wallet is compromised.
3. Higher insurance coverage and financial reserves
The FSC also wants cryptocurrency exchanges to review their insurance arrangements and maintain sufficient financial reserves.
These safeguards are intended to improve their ability to compensate customers affected by hacking incidents.
A cyberattack can create losses that extend beyond the immediate theft of cryptocurrency. Exchanges may also face operational disruption, customer claims and reputational damage.
Stronger insurance coverage and reserves could therefore help platforms manage the financial consequences of security incidents.
However, the effectiveness of these safeguards will depend on the coverage available, the amount of reserves maintained and the conditions under which customers can receive compensation.
Context is everything. Stay ahead of shifting trends with today’s market updates, and uncover emerging opportunities using the Serrari Group Market Index and Marketplace. Then, take control of your own financial future by exploring our Money & Life Reset Transformation Blueprint ™ to build stronger habits, create better systems, and design a path toward lasting wealth.
What Triggered the Regulatory Action?
The FSC’s announcement follows a series of security threats and incidents involving cryptocurrency businesses in South Korea.
Two cases involving GOPAX and Prabang have brought attention to the difficulties exchanges face when responding to suspected attacks.
GOPAX suspends services after receiving a hacking threat
On November 6, GOPAX suspended cryptocurrency trading, deposits and standard withdrawals after receiving an email threatening a cyberattack.
The exchange began transferring customer assets into cold wallets while investigating the threat.
Importantly, GOPAX reported that it had not detected an actual hacking attempt or cryptocurrency theft when it suspended services.
Customers could still request withdrawals through support channels, although requests required manual verification.
The incident illustrates the uncertainty surrounding preventive action. An exchange may consider a threat serious enough to suspend services even when it cannot establish that a breach has taken place.
Under the proposed guidance, exchanges could have clearer regulatory protection when taking such precautionary steps, provided they meet the required conditions.
Prabang reports approximately $70,000 in losses
A separate incident involving Prabang occurred on October 24, when the South Korean trading platform suspended services after detecting abnormal withdrawals from its hot wallet.
The platform reported losses of approximately $70,000.
It also said it would compensate affected customers using company funds.
Unlike the GOPAX incident, which involved a hacking threat without a confirmed breach, Prabang reported actual losses following abnormal wallet activity.
Together, the incidents demonstrate two different stages of a potential security problem: responding to a credible threat before a breach is confirmed and responding after suspicious transactions have resulted in losses.
The FSC wants exchanges to have stronger systems for identifying and addressing both situations.
How Serious Are Cybersecurity Weaknesses Across South Korea’s Financial Sector?
The regulatory response also comes amid wider concerns about cybersecurity across South Korea’s financial industry.
A review published in October identified cybersecurity weaknesses at 130 of 555 financial entities examined nationwide.
The FSC separately identified GOPAX operator Streami and Prabang among 16 organisations associated with earlier security incidents.
The figures suggest that security challenges are not limited to cryptocurrency exchanges. They form part of a broader issue involving financial institutions and businesses responsible for holding and managing customer assets.
At a November 12 security meeting chaired by FSC Vice Chairman Shin Jin-chang, regulators and representatives from exchanges including Upbit operator Dunamu, Bithumb and Coinone discussed the need for stronger security standards.
Shin said that some operators’ security awareness had not kept pace with the growth of the sector and emphasised that businesses holding customer assets should maintain security standards comparable to traditional financial institutions.
The regulator’s position reflects the increasing importance of cryptocurrency platforms within the financial system. As more customers use digital asset services, weaknesses in exchange security can expose a larger number of people to financial losses.
What Further Oversight Is South Korea Planning?
The FSC is also preparing additional cybersecurity inspections and support for smaller cryptocurrency businesses.
The Financial Security Institute (FSI) will expand its support for crypto companies through threat intelligence, vulnerability assessments and specialist training.
The regulator said only five of the 28 registered virtual asset service providers, the won-market exchanges, are currently members of the institute.
It plans to encourage more operators to join while providing alternative security support for businesses that are unable to become members.
The institute is also expected to update its security inspection standards by the end of 2026. The expanded standards will cover areas including:
- Transaction verification.
- Wallet access controls.
- Blockchain infrastructure.
- Smart contracts.
- Security monitoring and risk management.
These measures are intended to help exchanges identify weaknesses before they develop into incidents that affect customer assets.
Proposed Digital Asset Act
Beyond immediate security guidance, South Korea is preparing legislation that would introduce additional obligations for cryptocurrency businesses.
The proposed Digital Asset Act is expected to bring crypto operators closer to the information technology security and liability standards applied to traditional financial institutions.
The legislation would require businesses to meet stronger IT security requirements and assume liability for damages comparable to that of financial institutions.
This could increase the compliance responsibilities of cryptocurrency exchanges, particularly smaller operators that may have fewer resources to invest in cybersecurity systems and personnel.
However, the proposed legislation is still being prepared. Its final requirements and implementation arrangements will determine how much additional responsibility exchanges will carry.
What Does This Mean for Crypto Traders and Customers?
For cryptocurrency users in South Korea, the proposed changes could improve protection against losses caused by hacking incidents. However, they may also affect how quickly customers can access their funds during a security investigation.
Under the proposed framework, an exchange may temporarily block deposits and withdrawals when it suspects a cyberattack, even before a breach is publicly confirmed.
This means a withdrawal request could be delayed while the platform investigates suspicious activity.
Customers should also pay attention to exchanges that cannot maintain continuous security monitoring. Such platforms may be required to restrict deposits and withdrawals to staffed operating hours and provide advance notice.
The changes could therefore introduce additional restrictions on access to customer funds, even as regulators seek to reduce the risk of cryptocurrency theft.
The central challenge will be balancing customer protection with the right to access legitimate funds. Preventive freezes may help stop attackers, but poorly justified or prolonged restrictions could create difficulties for customers.
The conditions governing the no-action letter, the transparency of exchange communications and the speed of investigations will be important in determining how the new approach works in practice.
The Bigger Picture
South Korea’s proposed measures reflect a wider regulatory challenge facing cryptocurrency markets: how to protect customer assets in an industry that operates continuously and relies heavily on digital infrastructure.
Exchanges need to respond quickly to threats, but existing rules may not always provide enough clarity when a breach is suspected rather than confirmed.
By allowing preventive suspensions under specified conditions, the FSC is seeking to close this gap. At the same time, requirements around cold storage, monitoring, insurance and financial reserves indicate that regulators want exchanges to improve their security systems before incidents occur.
The proposals also carry implications for the wider cryptocurrency industry. South Korea is an active retail crypto market, and its regulatory approach may be watched by other jurisdictions considering how much discretion exchanges should have during security incidents.
However, the approach raises an important question: how can regulators prevent exchanges from using security concerns as a reason to restrict legitimate customer access without sufficient justification?
The success of the framework will depend not only on how quickly exchanges can freeze transactions, but also on how clearly they communicate restrictions, investigate incidents and restore services.
Why Does This Matter Now?
The proposed changes come as cryptocurrency businesses face growing pressure to demonstrate that customer assets are adequately protected.
Recent incidents involving GOPAX and Prabang have highlighted the risks of waiting for a confirmed breach before taking action. At the same time, the discovery of cybersecurity weaknesses across financial entities shows why regulators are seeking stronger oversight.
For traders, the changes could mean greater protection against losses but also the possibility of temporary withdrawal restrictions during suspected attacks.
For exchanges, the measures could increase operational and compliance costs as they invest in monitoring systems, security personnel, insurance and wallet protection.
For the wider industry, South Korea’s approach could offer an example of how regulators balance rapid cybersecurity intervention with customer rights.
The key development to watch is the final no-action letter and the conditions it attaches to preventive freezes. These will determine how exchanges exercise the new flexibility and what protections customers receive when access to their assets is restricted.
Frequently Asked Questions
1. Will South Korean crypto exchanges be allowed to freeze withdrawals without proof of hacking?
The FSC plans to issue a no-action letter allowing exchanges to temporarily suspend deposits and withdrawals when hacking or unauthorised access is suspected, subject to specified conditions. This is intended to clarify when preventive restrictions can be used before a breach is confirmed.
2. What is a cold wallet, and why does South Korea want exchanges to use it more?
A cold wallet stores cryptocurrency offline and is generally less exposed to internet-based attacks. South Korea already requires exchanges to hold at least 80% of customer cryptocurrency in cold storage, while the industry’s overall rate exceeds 95%. Regulators also want exchanges to keep hot-wallet balances to the minimum needed for routine transactions.
3. What happened to GOPAX and Prabang?
GOPAX suspended trading, deposits and standard withdrawals on November 6 after receiving a hacking threat, although it reported no confirmed breach. Prabang suspended services on October 24 after detecting abnormal hot-wallet withdrawals and reported losses of approximately $70,000.
4. Will the new rules affect cryptocurrency traders?
Yes. Traders may experience temporary restrictions on deposits and withdrawals when an exchange suspects a cyberattack. Platforms unable to provide round-the-clock monitoring may also have to limit transactions to staffed hours and notify customers in advance.
Your financial future isn’t something you wait for—it’s something you build.
The real question is: when do you begin?
Move beyond simply staying informed.
Navigate the markets with clarity—track trends through the Serrari Group Market Index, uncover opportunities in the Serrari Marketplace, and build practical knowledge with our Curated Wealth Builder Platform.
Stay connected to what truly matters.
Get daily insights on macro trends and financial movements across Kenya, Africa, and global markets—delivered through the Serrari Newsletter.
Growth opens doors.
Advance your career through professional programs including ACCA, HESI A2, ATI TEAS 7 , HESI EXIT , NCLEX – RN and NCLEX – PN, Financial Literacy!🌟—designed to move you forward with confidence.
See where money is flowing—clearly and in real time.
Track Money Market Funds, Treasury Bills, Treasury Bonds, Green Bonds, and Fixed Deposits, alongside global and African indexes, key economic indicators, and the evolving Crypto and stablecoin landscape—all within Serrari’s Market Index.
