South Korea Permits Crypto Exchanges to Halt Withdrawals During Hacks

The change responds to two recent incidents that exposed gaps in the country’s crypto oversight. GOPAX suspended services after a hacking alert, and Prabang shut down on October 24 after a $70,000 hot wallet breach. Both sit within a wider pattern of preventable losses across South Korea’s exchange ecosystem. In October, the FSC flagged 130 cybersecurity issues across 555 inspected firms and named GOPAX and Prabang among 16 companies with prior security incidents.

Closing the Gap Between a Threat and a Confirmed Breach

Under current rules, exchanges cannot block withdrawals without justifiable grounds, and restrictions are explicitly allowed only after a hack has been confirmed. That left a dangerous window between spotting a threat and proving a breach.

GOPAX shows how that plays out. On November 6, after receiving an email threatening a possible attack, it moved assets into cold storage even though no breach had been confirmed. Without regulatory cover, a precaution like that exposes an exchange to legal liability. The no-action letter, which is a regulator’s written promise not to penalize a specific behavior, treats early action as compliant conduct as long as exchanges meet the defined conditions.

The FSC is pairing the relief with tougher security expectations:

• 24/7 monitoring, increased use of cold wallets, and enhanced insurance and reserve funds
• Exchanges that cannot monitor around the clock may process deposits and withdrawals only during staffed hours, and must notify users in advance
• A possible new cold-storage minimum above the current 80%

The tiered approach lets smaller platforms operate within their capacity while larger exchanges absorb the cost of constant vigilance. More assets offline also means less hot-wallet exposure, the weak point in the Prabang breach, though it can slow large withdrawals. How aggressively the FSC raises the cold-storage floor will come down to that trade-off between security and liquidity.

Hashlytics Take

The most telling part of this move is that the FSC is solving the problem with a letter rather than a rule change. A no-action letter gives exchanges comfort to freeze first and explain later, but it also puts the judgment call about what counts as a credible threat on the exchanges themselves. GOPAX acted on a single threatening email, and users will want to know where “suspected” ends and “overcautious” begins. The tiered monitoring rule raises a harder question: a smaller exchange that only processes withdrawals during staffed hours is, in effect, telling users their funds are inaccessible part of the day. Prabang covered its customers’ losses from its own balance sheet, and not every small exchange will be able to. That is why prevention, not compensation, is the right focus, and why the cold-storage floor deserves more attention than the freeze power.