Korea's Real-Time Reconciliation Rule for Crypto Exchanges

Video transcript

Korea's regulator says crypto exchanges will be required to reconcile ledger to wallet every five minutes, with an automated kill switch on large mismatches.

In February, a Bithumb promotion meant to pay winners in won credited bitcoin instead. About 620,000 bitcoin went out, media reports cited by Reuters said.

Inspections found three of five major exchanges reconciled only on a 24-hour cycle. Kill switch preparations were inadequate, accounting firm checks were quarterly, and most had weak manual payout controls.

The FSC's answer: reconcile every five minutes, set kill switch criteria, have accounting firms verify monthly, not quarterly, and disclose quantities per wallet and per ledger.

One caution. We found no public DAXA text setting the five-minute cycle or kill switch thresholds, and no announcement that the framework law has passed.

Build it in four parts: snapshot balances per asset, index every wallet at a pinned block height, compare against a tolerance band, and let large breaks trip the kill switch.

A kill switch that trips on noise gets switched off. Model pending deposits, sweeps, withdrawals in flight, reorgs and node lag, then test the halt on every chain.

Guardian's Managed Security watches onchain and offchain activity around the clock, with a 15-minute SLA on Critical alerts. Read the full article, or talk to Guardian at guardian.security about testing your reconciliation and kill switch.

On February 6, 2026, at around 7 p.m., Bithumb paid out bitcoin by mistake, Korea’s Financial Services Commission (FSC) said.

A promotion meant to pay winners 2,000 won or more credited at least 2,000 BTC each instead, media reports cited by Reuters said. About 620,000 BTC went out in all.

Two months later, the FSC set out what exchanges will be required to build so the next error is caught in minutes, not a day.

DAXA’s new risk management rules took effect on June 30, 2026. The framework law meant to carry key details is still pending, as far as we can find.

This article explains the technical and security side of the FSC’s April 6, 2026 measures on real-time balance reconciliation and internal control at virtual asset exchanges. It is not legal advice; confirm how it applies to you with counsel.

What Happened at Bithumb

Bithumb said the incident was “unrelated to external hacking or security breaches.” It restricted trading and withdrawals for affected customers within 35 minutes, Reuters reported.

Bitcoin on Bithumb briefly fell 17% to 81.1 million won.

By February 9, authorities said 86 customers had sold some or all of the bitcoin they received, Yonhap reported. Bithumb said about 125 BTC, around 13 billion won, was still unrecovered.

The FSC, KoFIU, the Financial Supervisory Service (FSS) and DAXA set up an emergency response unit on February 7. The FSC ordered inspections of every exchange.

The FSS found internal control deficiencies at Bithumb in an inspection from February 10 to March 6. The FSC said the sanctions process will start once the legal examination is complete.

What the Inspections Found

On April 6, the FSC met five major exchanges and the Digital Asset eXchange Alliance (DAXA), their self-regulatory alliance. Its findings:

• Slow reconciliation: three of five reconciled ledger to wallet on a 24-hour basis.
• No kill switch: no adequate preparations to halt transactions on a significant gap.
• Thin verification: accounting firms checked quarterly, and disclosure was perfunctory.
• Manual payouts: weak controls at most exchanges over staff-entered transactions, such as reward payouts.
• No playbook: most lacked procedures for emergencies, human error or system failures.

The FSC said a 24-hour cycle left exchanges “incapable of timely responses when an accidental payout takes place.”

The New Requirements

Exchanges “will be required to set up a ledger-to-wallet balance reconciliation system on a real-time basis (every five minutes).” The rest of the package:

The unit check fits the Bithumb error: a reward planned in won was paid in bitcoin.

Manual payouts need the same dual control as large withdrawals. Our insider threat program template sets that out.

Where the Rules Stand

The release announces measures; it is not the rule text. The FSC and DAXA planned rule changes within April 2026 and reconciliation systems by May.

What we could confirm in DAXA’s public documents:

• Risk Management Model Guidelines (enacted June 4, in force June 30, 2026): a risk management committee and at least one risk management officer.
• Manual transactions: preset limits, separate maker and approver, multi-step approval and an independent cross-check.
• Halt on limits: stop a transaction when an input exceeds its preset limit.
• Standard Internal Control Standards (revised the same day): internal control checks every six months, reported to the board and DAXA.
• Holdings checks: periodic, verified by an accounting firm. The text sets no frequency.
• Disclosure: a DAXA page linking each member exchange’s daily reconciliation results.

We found no public DAXA text that sets the five-minute cycle or kill switch thresholds. Confirm the operative text with DAXA.

The FSC said key details will be “adequately incorporated into the currently pending framework law on digital assets.” We found no FSC announcement of its passage as of November 5, 2026.

In February, the FSC said the pending virtual asset bill would make exchanges “strictly liable” for user losses from errors in their data processing systems.

Architecture of a Five-Minute Check

Reconciliation compares two numbers per asset: what the ledger owes customers and what the wallets hold.

Ledger snapshots

Take a consistent snapshot of customer balances per asset, with an ID and timestamp. Include pending withdrawals and internal transfers.

Wallet indexing

Index every hot, cold, omnibus and deposit address at a pinned block height. Read from your own nodes and check against a second source.

Tolerance bands

Set a band per asset, as an amount and a percentage. Small breaks open a ticket; large ones trip the kill switch.

Direction matters. A ledger above the wallets means customers are owed more than you hold, which is what an erroneous payout creates.

Kill switch design

• Scope the halt: that asset’s withdrawals first, then its trading.
• Trip automatically; resume only with two named approvers.
• Alert on stale runs: a check that stops running is a failure.
• Log each run: block height, snapshot ID, both totals and the gap.

Our exchange incident response plan lists a ledger that stops reconciling as a reason to declare an incident.

Avoiding False Halts

A kill switch that trips on noise gets switched off. Model the known gaps:

• Pending deposits: onchain, but below your confirmation threshold.
• Sweeps: funds moving from deposit addresses to hot wallets.
• Withdrawals in flight: debited in the ledger, broadcast, not yet confirmed.
• Fees: network fees paid from house funds.
• Reorgs: count only blocks past a per-chain confirmation depth.
• Off-wallet assets: staked, locked or held with a third-party custodian.
• Node lag: an indexer behind the chain tip reads as a shortfall.

Track each as an explicit list of in-flight items. The band judges what is left.

Then test the halt on a schedule, on every chain, and time it.

How Guardian Helps

Guardian’s Managed Security watches onchain and offchain activity around the clock, with an engineer on every alert and a 15-minute SLA on Critical alerts.

Guardian’s offchain automation pentest reviews risk engines and scheduled jobs from source, including whether a failing job “halts safely or keeps acting.”

Our regulatory readiness assessments list each provision with the control that meets it and the evidence that proves it.

Japan took a different route. See the FSA’s exchange cybersecurity policy.

Frequently Asked Questions

What reconciliation does South Korea require crypto exchanges to run?

Ledger-to-wallet reconciliation every five minutes, under measures the FSC announced on April 6, 2026, with an automated kill switch on large mismatches. Accounting firms are to verify monthly, and disclosures to show quantities per wallet and per ledger.

What is a kill switch at a crypto exchange?

An automated control that halts transactions when a check fails. The FSC found exchanges had no adequate kill switch preparations, and said specific criteria will trigger one when reconciliation shows a large-scale mismatch.

Is the five-minute rule in Korean law?

The FSC and DAXA planned rule changes within April 2026; the pending framework law is to carry key details. We found no public text setting the five-minute cycle, and no announcement that the law has passed.

Was the Bithumb incident a hack?

Bithumb said it was “unrelated to external hacking or security breaches.” The FSC calls it an erroneous payout. Per Reuters, a promotion meant to pay won credited bitcoin instead, about 620,000 BTC in all.

Sources

• FSC: Real-Time Balance Reconciliation and Enhanced Internal Control Required for Virtual Asset Exchanges (April 6, 2026)
• FSC: FSC Holds Meeting to Review Situations over Bithumb’s Erroneous Payouts and Discuss Improvement Measures (February 8, 2026)
• DAXA: Risk Management Model Guidelines for Virtual Asset Service Providers, in Korean (June 4, 2026)
• DAXA: Standard Internal Control Standards, revised, in Korean (June 4, 2026)
• DAXA: Exchange balance reconciliation result disclosures, in Korean (accessed November 5, 2026)
• Reuters via The Star: South Korean crypto firm accidentally sends $44 billion in bitcoins to users (February 7, 2026)
• Yonhap via The Korea Herald: 86 customers sold bitcoins accidentally sent by Bithumb: authorities (February 9, 2026)
• Guardian: Crypto Exchange Incident Response Plan: The First Hour
• Guardian: Insider Threat Programs for Crypto Exchanges: A Template