Korea's FSC Lets Exchanges Freeze Withdrawals on Suspected Hacks
South Korea's Financial Services Commission will let crypto exchanges suspend deposits and withdrawals the moment they suspect a hack, without waiting for the breach to be confirmed. The regulator said on Thursday that it would issue a no-action letter covering those preventive suspensions, a written promise that it will not penalize conduct the current law leaves unclear. Conditions attach to the relief. The FSC has not published them. Three accounts read on Thursday agree on the decision and on the gap it closes, and none of them carries the fine print.
The law told exchanges to wait for proof
Under the Virtual Asset User Protection Act, an exchange may not restrict customer deposits and withdrawals without legitimate grounds, and the law permits a suspension only once a hacking incident is clearly established. Operators had told the regulator they did not know where that left them when they saw abnormal transfers but could not yet confirm an attack, crypto.news and The Crypto Times both reported. The letter answers that one question. It does not hand exchanges open-ended power over customer money, and the conditions defining a suspected hack are the part nobody outside the FSC has seen.
Two incidents the regulator keeps citing
On 24 October the coin-market exchange Prabang detected abnormal withdrawals from its hot wallet, the internet-connected wallet an exchange uses to process everyday payouts, and lost about 100 million won, roughly $70,000. It promised to cover customer losses from company funds. Thirteen days later the opposite case arrived. GOPAX received an emailed threat and suspended trading, deposits and withdrawals before anything had happened, then moved customer assets into cold wallets. It reported no theft and no detected intrusion. One exchange lost money it could not stop leaving — the other stopped money moving over a threat that may have been empty.
Guidelines written before the statute
The FSC also drafted emergency response guidelines for exchange security incidents, to apply while the Digital Asset Basic Act is still pending. Exchanges would monitor around the clock with staff on duty, and any that cannot would process deposits and withdrawals only during staffed hours, telling users in advance. They would keep as much customer crypto offline as they can, hold only working balances in hot wallets, and expand insurance limits and reserve funds.
The cold-storage floor in law is 80%. On the FSC's own data the industry already sits above 95%, with wide variation between firms, and the regulator put no new number on any of it. Crypto Briefing wrote on Thursday morning that the FSC has called for raising the 80% minimum. crypto.news and The Crypto Times both report that no figure was set. Those accounts do not reconcile.
Where the liability lands next
Vice Chairman Shin Jin-chang, who chaired Thursday's meeting, put it to the operators in their own terms, in a translation carried by one Korean outlet and relayed by a single account read here.
"Some operators' security awareness remains stuck in the era before institutionalization," he said.
The quote stands on that one account. Its direction sits in the others. The pending Digital Asset Basic Act would write IT safety duties and liability for damages into statute, putting exchanges on the same footing as banks and brokerages. Supervision is thinner than that sounds in the meantime. Five of the country's 28 registered providers belong to the Financial Security Institute, all of them won-market exchanges, and the institute will revise its exchange-specific inspection standards by the end of the year. Seoul has been tightening since the hot-wallet theft at Binance on 29 October, which the exchange put at $6.3 billion against Chainalysis's $5.9 billion. What the letter is worth turns on a definition that has not been published.
Read also: Bithumb Confirms a Groupware Breach as Daishin Counts 38,490