South Korean authorities plan to let crypto exchanges suspend deposits and withdrawals when they detect signs of hacking, before an actual breach is confirmed. Korean reporting on November 12 describes a Financial Services Commission package combining earlier intervention with stronger exchange security requirements.
The change concerns timing. Exchanges would have a clearer basis to stop transfers while investigating suspicious activity. The reported mechanism is a planned regulatory no-action opinion under specified conditions, rather than a newly enacted law granting unrestricted freezing powers.
Suspicion becomes a basis for stopping transfers
Newsway reports that the Virtual Asset User Protection Act prohibits exchanges from blocking customer deposits and withdrawals without a legitimate reason. A confirmed hacking incident provides grounds for a suspension. The uncertainty concerns the period when unusual transactions suggest trouble but investigators have yet to establish an intrusion.
The FSC plans to address that uncertainty through a no-action opinion permitting preventive restrictions under certain conditions.
For an exchange handling a possible compromise, the decision involves competing risks. Keeping withdrawals open could let unauthorized transfers continue. Closing them interrupts legitimate customers, including people trying to move funds away from the exchange.
The proposed approach gives operators more room to intervene during that investigation. Its usefulness will depend on matching the response to the suspicious activity. An exchange that pauses transfers still has to investigate the threat and manage the customers waiting for access.
GOPAX already exposed the cost of precaution
GOPAX supplied a concrete example on November 6. According to Yonhap, the exchange suspended withdrawals at 2:55 p.m. local time after receiving a hacking threat, then halted trading at approximately 3:53 p.m.
It also temporarily suspended crypto deposits and canceled outstanding orders. Assets held in internet-connected hot wallets were being moved into offline cold wallets.
At that point, GOPAX said it had not verified the threat's credibility and reported no actual asset losses. The shutdown was a precaution taken in response to a threat, not a confirmed theft.
Customers nevertheless experienced an interruption across several services. Someone with an outstanding order lost the ability to execute that order; someone seeking a normal withdrawal faced a closed channel.
That episode illustrates the operational stakes behind the policy. A preventive response can protect assets while reducing access to them. Both outcomes belong in the assessment of an exchange's incident handling.
For users comparing exchange custody with holding assets in their own wallet, access control is a practical consideration: an exchange's emergency decision can determine when funds become available to move.
Permission to pause comes with more security work
The wider package also addresses exchanges' ability to detect and contain threats.
Yonhap Infomax reports that operators unable to maintain continuous security monitoring would process deposits and withdrawals only during hours when monitoring is available. This would tie transfer availability to the exchange's capacity to supervise those transfers.
Authorities are also seeking to reduce assets exposed through online wallets. The existing cold-storage minimum is 80% of customer crypto assets. The package calls for keeping hot-wallet holdings to the minimum needed to support transactions and considering distribution across multiple hot wallets.
These measures address different parts of an incident. Monitoring helps identify suspicious activity. Smaller hot-wallet balances reduce the assets exposed through those wallets. A transfer pause provides time to investigate.
Insurance coverage and reserves are also to be expanded to support customer compensation following losses.
Separately, EDaily reports that only five of South Korea's 28 virtual asset businesses belong to the Financial Security Institute. Authorities intend to expand participation and provide security support for smaller operators unable to join.
Planned inspection standards would account for blockchain systems, wallets and smart contracts, with revisions targeted before year-end. The proposed Digital Asset Act would introduce financial-company-level IT safety duties and liability for damages. Those legislative measures remain distinct from the nearer-term guidance and no-action approach.
The package therefore pairs clearer permission to interrupt transfers with demands for exchanges to invest in prevention and response.
Overview
South Korea plans to clarify when exchanges can stop deposits and withdrawals during suspected hacking incidents. The immediate mechanism is a conditional no-action opinion, accompanied by stronger monitoring, custody controls and security support.
GOPAX's November 6 shutdown illustrates the customer impact of acting before a threat is verified. Authorities are pairing that ability to act early with demands for better detection and containment, including limiting transfer processing to monitored hours when continuous coverage is unavailable.
