Korea to Let Exchanges Halt Withdrawals on Suspected Hacks

By Owen ThurmPublished November 12, 202611 min read

Quick answer. On November 12, 2026, Korea's FSC said it plans a no-action letter letting exchanges block deposits and withdrawals, under conditions not yet published, when a hack is suspected. Emergency guidelines add 24/7 monitoring or staffed-hours transfers, and smaller hot wallets.

Watch: Korea to Let Exchanges Halt Withdrawals on Suspected Hacks 1:37

Video transcript

Korea's Financial Services Commission plans to let crypto exchanges block deposits and withdrawals when a hack is only suspected, not yet confirmed.

The law allows a block only when a hack is evident, leaving the suspicion stage unclear. A planned no-action letter fills that gap, under conditions not yet published.

Emergency guidelines add round the clock monitoring, or transfers only in staffed hours. Hot wallets should be small and split, backed by enough insurance and reserves.

Korea's supervisory minimum for cold wallets is 80 percent of customer assets. The FSC says the industry already runs above 95 percent.

Much is still open. The letter's conditions are unpublished, and no alert thresholds, decision owner, maximum freeze length or resume procedure are specified.

Guardian's analysis: design the halt first. Define triggers, name a decision owner on every shift, scope each halt by wallet, asset and chain, and write the resume path.

Halts can misfire. In a Guardian review of a Synthetix withdrawal flow, a global pause stalled an event listener, so later deposits were not credited offchain.

Start now. Log every halt and resume, add financial authorities to your notification path, and size each hot wallet to transaction need.

Read the full article for the checklist. Guardian Managed Security puts an MDR team on every alert around the clock. Talk to us about triggers and halt paths at guardian.security.

What the FSC Announced

South Korea's Financial Services Commission (FSC) will let crypto exchanges block deposits and withdrawals when a hack is only suspected, not yet confirmed. Financial Services Commission of Korea, Bloomingbit, citing Korea Economic Daily

It announced the plan on November 12, 2026, after a security meeting chaired by Vice Chairman Shin Jin-chang at 4:30 p.m. KST (07:30 UTC).

The package also covers 24/7 monitoring, smaller hot wallets, compensation funds, wider Financial Security Institute membership and new inspection criteria.

This article covers the technical and security side only. It is not legal advice; confirm how it applies to you with counsel.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

Halting on Suspicion

Korea's Virtual Asset User Protection Act bars exchanges from blocking deposits and withdrawals without a justifiable reason. It allows a block only when a hacking incident is evident. Financial Services Commission of Korea

That left it unclear whether an exchange could act at the suspicion stage, such as on abnormal transactions, the FSC said.

The FSC will close that gap with a no-action letter. It will let exchanges block deposits and withdrawals preemptively, under conditions, when hacking is suspected. Bloomingbit, citing Korea Economic Daily

The FSC said the Binance incident showed that a fast suspension is decisive in limiting user losses.

A 24/7 Monitoring Duty

The FSC has set out emergency response guidelines for security incidents at virtual asset businesses. Financial Services Commission of Korea, Bloomingbit, citing Korea Economic Daily

Yonhap reports the guidelines are meant to apply before the proposed Digital Asset Act. Yonhap News Agency

Because the market trades around the clock, firms are to keep monitoring and response staff in place at all times.

When abnormal large transactions or other signs of an incident appear, staff are to apply controls immediately.

The guidance also calls for prompt notice to financial authorities when an incident occurs or abnormal external access suggests an intrusion.

On November 5, the FSC said exchanges then reported hacks only to KISA, and that November guidelines would require immediate reports to financial authorities.

Firms that cannot staff monitoring around the clock may process transfers only during staffed hours. They must tell users in advance and staff enough to handle requests promptly.

GOPAX shows the trade-off: since its November 6 emergency halt, withdrawals need an emailed request and manual approval in business hours. That is a halt measure, not the FSC regime. GOPAX Help Center

For smaller exchanges, that fallback is a real choice. Slower withdrawals during unstaffed hours may cost less than an unwatched hot wallet.

Smaller Hot Wallets, More Cover

Korea's supervisory regulation sets an 80% minimum for customer assets in cold wallets. Across all firms, the FSC says, the cold share is above 95%. Financial Services Commission of Korea, Bloomingbit, citing Korea Economic Daily

The FSC now asks firms to keep hot wallet customer assets to what transactions need. Balances should be spread across several hot wallets.

Splitting caps what one compromised wallet can lose. It also gives a halt a smaller, clearer scope.

Firms are also to hold insurance limits and reserves large enough to compensate users for hacking losses.

Our guide to hot, warm and cold wallets compares how Hong Kong, Japan, Singapore and Dubai set the cold share.

Inspections and Information Sharing

Only 5 of 28 virtual asset businesses have joined the Financial Security Institute (FSI): Dunamu, Bithumb, Coinone, Digital X and Streami, all won-market exchanges. Financial Services Commission of Korea

The FSC plans to widen membership with each firm's scale in mind. Members get threat information sharing, vulnerability checks and training. Bloomingbit, citing Korea Economic Daily

Yonhap reports the aim is to bring in the remaining firms. Neither source names targets or sets a timetable. Yonhap News Agency

Security inspection criteria are to be revised within 2026 to address exchange-specific risks.

The revisions add transaction verification and wallet access controls. Separate criteria will cover virtual asset compliance, blockchain, wallets and smart contracts, reflecting cloud-heavy operations and hot wallet theft threats.

The FSC's earlier measures after Bithumb's erroneous payout are in our Korea real-time reconciliation rule explainer.

Where the Law Stands

Longer term, a draft Digital Asset Act would hold firms to financial-company-level IT safety duties and liability for damages, the FSC says. It gives no bill number, filing or effective date. Financial Services Commission of Korea, Bloomingbit, citing Korea Economic Daily

A separate lawmaker's bill, Min Byung-deok's Digital Asset Basic Act (bill 2210736), was introduced on June 11, 2025. The Assembly record's last action is committee agenda placement on August 26, 2025. Republic of Korea National Assembly Bill Information System, Ministry of Government Legislation, Republic of Korea

The Incidents Behind It

The release cites the Binance hack but names no Korean incident. Financial Services Commission of Korea

About $6.36 billion left Binance wallets on October 29, 2026, per TRM Labs, and about $2.7 billion was later frozen. Our Binance hack explainer has the timeline. Guardian Resource Hub

At home, GOPAX stopped deposits and ordinary withdrawals at 14:55 KST on November 6 after a hacking threat. It moved most hot wallet assets to cold storage. GOPAX Help Center, Yonhap News Agency

It halted trading at 15:53 KST and cancelled open orders. It reported no confirmed asset loss and has set no date for normal service.

Earlier, Pravang detected unauthorized hot wallet withdrawals on October 24. It estimated losses at about 100 million won, suspended services and said it would cover verified losses with company funds. KBS World

GOPAX blocked on a threat it had not verified as an intrusion. That is the suspicion-stage decision the no-action letter is meant to address.

What Is Still Open

The release sets direction, not final text. Several gaps matter for system design. Financial Services Commission of Korea

The no-action letter's conditions, scope, documentation requirements and issue date are not published.
No separate publication or effective date is given for the emergency response guidelines. Yonhap News Agency
No numeric alert thresholds, decision owner or maximum freeze length are specified.
No customer appeal or resumption procedure is described.
Pravang's final loss and technical root cause remain unresolved. KBS World
Binance's loss and freeze totals are third-party estimates, not an FSC finding. Guardian Resource Hub

Guardian Analysis: Design the Halt First

Halting on suspicion moves the decision earlier, when evidence is thin. That works only if triggers and authority are written down beforehand.

Define triggers now: an outflow with no withdrawal ID, a velocity breach, a ledger mismatch, a signing request nobody queued. Our hot wallet monitoring guide covers rules like these.

Name a decision owner on every shift, with a backup, who can halt without calling a meeting.

Scope each halt by wallet, asset and chain. A blanket stop hits users the incident never touched.

Write the resume path too: who approves, what evidence clears the suspicion, and how users hear about it.

Guardian's public reports show how a halt can misfire. In a Synthetix withdrawal flow review, a global withdrawal pause left an event listener retrying reverting disbursals. Guardian Security

The listener stopped advancing its block checkpoint, so later deposits were not credited offchain. A withdrawal pause became a deposit outage (High, H-04).

A search of all 321 public Guardian reports for the phrase withdrawal pause matched two, both Synthetix reviews. That is a keyword sample, not a failure rate.

So test a halt as a system: pause, confirm deposits still credit, replay checkpoints, then resume under approval.

For the first hour after a halt, use our exchange incident response plan.

Checklist for Exchanges in Korea

Teams can start now, before the letter's conditions are published.

Log who halted, who resumed, and the evidence, for supervisory review.
Add financial authorities to your incident notification path, alongside KISA.
If 24/7 coverage is not possible, map transfer processing to staffed hours.
Draft the advance user notice for staffed-hours processing now.
Size each hot wallet to transaction need and split balances across wallets.
Check insurance limits and reserves against your largest hot wallet balance.
Track the no-action letter and the year-end inspection criteria as they are published.

Frequently Asked Questions

Does the no-action letter change Korea's law?

No. A no-action letter states in advance that the regulator will not sanction a defined action. The statutory rule against unjustified blocks stays in place; the letter is conditional regulatory assurance, not an unrestricted power to freeze customer funds. Financial Services Commission of Korea, Bloomingbit, citing Korea Economic Daily

Who attended the FSC's November 12 security meeting?

FSC and Financial Supervisory Service officials, the Financial Security Institute, nine exchanges (five won-market, four coin-market), custodians KODA and KDAC, and DAXA's standing vice chair, per the FSC release. Financial Services Commission of Korea

How can GOPAX users withdraw during its halt?

Identity checks include a selfie holding ID and a handwritten note. Only whitelisted personal wallets qualify, with no transfers to other exchanges. Approvals run weekdays 10:00 to 19:00 KST, per GOPAX's help center. GOPAX Help Center

Sources

Monitoring that can act on suspicion

Guardian Managed Security puts an MDR team on every alert around the clock, watching privileged calls, multisig transactions and large fund movements. Talk to us about triggers and halt paths.

Talk to Guardian Explore the service