South Korea to Allow Crypto Exchanges to Freeze Withdrawals When Hacking Is Suspected

South Korea’s Financial Services Commission (FSC) has announced emergency cybersecurity measures for cryptocurrency exchanges, including permission to suspend customer deposits and withdrawals when a hacking incident is suspected, rather than waiting until a breach has been conclusively established. The measures form part of a wider effort to strengthen the protection of digital assets following a series of cyberattacks and security incidents affecting financial institutions and cryptocurrency businesses.

The announcement was made on 12 November 2026 during a meeting between the FSC, the Financial Supervisory Service, the Financial Security Institute and representatives of the virtual asset industry. The meeting was chaired by FSC Vice Chairman Shin Jin-chang and focused on improving the industry's ability to prevent security breaches, detect suspicious activity and respond to incidents.

A central element of the new approach is the introduction of a regulatory no-action letter allowing cryptocurrency exchanges to block deposits and withdrawals pre-emptively when there are reasonable indications of hacking or a security breach. Under the existing Virtual Asset User Protection Act, exchanges are generally prohibited from restricting customer deposits and withdrawals without a justifiable reason. Restrictions are permitted when a hacking incident is evident, but the legal position has been less clear where suspicious activity indicates a possible attack before it has been confirmed.

The FSC intends to address this uncertainty by clarifying that exchanges may take precautionary action under specified circumstances. The purpose is to allow operators to respond quickly to abnormal transactions or suspected intrusions before substantial amounts of customer assets can be transferred out of their systems. The precise conditions governing the use of this authority and the date of issuance of the no-action letter have not yet been specified.

The decision follows a series of security incidents involving cryptocurrency platforms. South Korean authorities have been particularly concerned about vulnerabilities affecting hot wallets, which are connected to the internet and therefore more exposed to cyberattacks. Recent incidents have demonstrated the speed at which digital assets can be transferred once unauthorised access has been obtained, making rapid intervention an important component of customer protection.

The FSC is also requiring cryptocurrency businesses to strengthen their monitoring and incident-response arrangements. Given that digital-asset markets operate continuously, exchanges are expected to maintain 24-hour monitoring capabilities and ensure that personnel are available to respond to suspicious activity, including abnormal large transactions.

Businesses that cannot maintain continuous monitoring will be permitted to process deposits and withdrawals only during the hours in which appropriate monitoring is available. They will be required to inform customers of these operating hours in advance and ensure that withdrawal requests are handled promptly during the relevant periods. This introduces an operational requirement that may be particularly challenging for smaller exchanges with limited staffing and security resources.

Another major area of focus is the storage of customer assets. South Korean regulations already require virtual asset service providers to maintain at least 80% of customer assets in cold wallets, which are kept offline and are less exposed to internet-based attacks. The FSC stated that the industry's actual cold-wallet storage ratio currently exceeds 95%.

Despite this relatively high level, the regulator wants exchanges to minimise the amount of cryptocurrency held in hot wallets, retaining only the balance necessary to support ordinary trading and withdrawals. It is also considering the distribution of assets across multiple hot wallets to reduce the potential impact of a compromise affecting any individual wallet.

The authorities are additionally seeking stronger financial protection for customers in the event of security incidents. Exchanges will be expected to increase insurance coverage and maintain sufficient reserves to compensate users for losses resulting from hacking attacks. These requirements are intended to improve the industry's ability to respond financially when preventive controls fail and customer assets are affected.

The emergency measures also introduce expectations for information technology security that are comparable to those already imposed on traditional financial institutions. Cryptocurrency businesses will be expected to establish appropriate technical, administrative and physical safeguards for their systems and electronic transactions, regularly assess vulnerabilities in their information systems and networks, and address identified weaknesses.

They will also be required to report security breaches and indications of abnormal external access promptly to the financial authorities. This is intended to improve the speed with which regulators can identify emerging threats, coordinate responses and prevent incidents at one platform from creating wider risks for the domestic digital-asset market.

The FSC plans to expand the role of the Financial Security Institute in supporting and inspecting cryptocurrency businesses. Currently, only five of South Korea's 28 virtual asset service providers are members of the institute. The regulator intends to encourage the remaining businesses to join, taking account of their size and operational circumstances.

Members will have access to information about security threats, vulnerability assessments and specialised training. Businesses that are unable to join will receive alternative support comparable to that available to smaller financial institutions. The institute will also develop revised security inspection standards specifically for cryptocurrency exchanges, covering areas such as regulatory compliance, blockchain infrastructure, wallet security and smart contracts. The updated standards are expected before the end of 2026.

The measures build on a broader security inspection programme announced by South Korean financial authorities on 5 November. That initiative covers approximately 580 financial companies, electronic financial service providers and virtual asset businesses and requires comprehensive reviews of externally accessible information technology systems and internal security controls.

In the longer term, the FSC intends to incorporate stronger cybersecurity obligations into the Digital Asset Act currently under preparation. The proposed legislation is expected to impose information technology security responsibilities on digital-asset businesses comparable to those applicable to financial institutions, together with liability for damages arising from security failures. The emergency guidelines are intended to strengthen protections while the legislative process continues.

For cryptocurrency exchanges and custodians, the announcement creates several immediate compliance priorities. Businesses will need to review their withdrawal suspension procedures, establish clear escalation criteria for suspected security incidents, assess whether their monitoring arrangements provide adequate 24-hour coverage and ensure that customers are informed of any restrictions on deposit and withdrawal processing.

Operators should also reassess their hot-wallet exposure, cold-storage arrangements, insurance limits and financial reserves. In addition, incident reporting procedures and vulnerability management systems will need to reflect the regulator's expectations for rapid identification, escalation and remediation of security threats.

The proposed ability to suspend withdrawals before a breach is confirmed also raises important operational considerations. While precautionary restrictions may prevent further losses during an attack, exchanges will need clear internal procedures to ensure that such measures are proportionate, properly documented and lifted once the relevant security concerns have been addressed.

South Korea's approach reflects a broader regulatory shift towards treating cryptocurrency businesses more like traditional financial institutions in relation to cybersecurity, operational resilience and customer asset protection. The combination of preventive transaction restrictions, continuous monitoring, stronger wallet controls and potential liability for security-related losses signals increasing expectations for the governance and risk management of digital-asset service providers.

By fLEXI tEAM