South Korea lets crypto exchanges freeze withdrawals on suspicion of hacking

The FSC said on Thursday that it would issue a no-action letter allowing preventive suspensions under certain conditions. A no-action letter is a regulator’s written promise not to penalize a specific behavior.

The shift moves the trigger point from “confirmed breach” to “suspected breach.” That is a meaningful change for platforms that often get only minutes to respond to an attack.

The specific conditions attached to the relief were not detailed in the announcement. A loosely defined trigger could let exchanges freeze user funds for convenience. A tightly defined one could leave them hesitating in the very moments the policy is meant to address.

Recent cyber incidents

Two recent episodes appear to have shaped the decision. On November 6, the exchange GOPAX suspended operations after receiving a threatening email. It moved assets into cold storage even though no breach had been confirmed.

The second case went further. On October 24, the platform Prabang lost approximately 100 million won (about $70,000) from its hot wallet. A hot wallet is the internet-connected wallet an exchange uses to process everyday withdrawals.

These cases were not isolated. According to the research findings, more than 37 financial firms in South Korea were hit by cyber incidents between late September and early November 2026. Around 473,000 records were exposed, and roughly 1 billion won was stolen from hot wallets and other targets.

Security measures and next steps

The FSC held an emergency meeting on November 2 as the wave of attacks escalated. The regulator has since urged exchanges to tighten their security protocols.

One key measure involves cold storage. Exchanges must currently keep at least 80% of assets in cold wallets, which are offline and much harder to reach remotely. The FSC has called for raising that minimum.

The Prabang case also raises a quieter question about who absorbs losses. Prabang chose to cover customer losses itself. Not every small exchange will have the balance sheet to do the same, which is part of why preventing theft matters more than compensating for it.

Several things are worth watching from here. The first is the fine print of the no-action letter, especially how “suspected hacking” gets defined and how long a freeze can last. The second is where the FSC sets any new cold-storage minimum above the current 80%.