At a glance

  • Korean crypto exchanges will be able to halt deposits and withdrawals pre-emptively when a hack is suspected, under conditions, through a no-action letter from the Financial Services Commission (FSC), the regulator said on Thursday (Korean).
  • Exchanges must also staff security monitoring 24 hours a day. Those that cannot should process withdrawals only during staffed hours and tell users in advance.

South Korea’s Financial Services Commission (FSC), the country’s top financial regulator, set out the measures at a security meeting with exchanges and custodians in Seoul at 16:30 Korea time on Thursday 12 Nov (07:30 UTC, 08:30 CET). Vice Chairman Shin Jin-chang chaired it.

A no-action letter is a written assurance from the regulator that it will not sanction a firm for a specific step. The FSC has not published the conditions that will apply.

What changes for withdrawals

Under the Virtual Asset User Protection Act, an exchange may not block deposits or withdrawals without a legitimate reason, and it allows a block only when a hack has clearly happened. Exchanges told the FSC it was unclear whether they could act earlier, for example when unusual transactions appear.

The FSC said fast blocking is decisive in limiting user losses, “as seen in cases such as the Binance hack” (translated), a reference to the $6.3 billion theft from Binance last month. It will therefore issue the letter so exchanges can freeze deposits and withdrawals when a hack or breach is suspected.

The context is recent. Gopax halted trading and withdrawals after a threat email on 6 Nov, before it had confirmed any breach, and the FSC already held an emergency meeting with exchanges after the Binance hack.

The emergency guidelines

The FSC also issued emergency response guidelines for security incidents that apply now, before its draft Digital Asset Act becomes law. According to the release:

  • Exchanges must monitor around the clock and act at once on signs of an incident, such as abnormal large transactions.
  • A firm that cannot run that system at all hours should process deposits and withdrawals only when it can, announce those hours in advance and staff enough people to handle requests on time.
  • Rules require exchanges to hold at least 80% of customer crypto in cold wallets, storage kept offline. The FSC says the industry already holds more than 95% that way, but it wants hot-wallet balances cut to the minimum trading needs and spread across several wallets.
  • Insurance cover and reserves should be large enough to compensate users after a hack.
  • Firms must assess their systems for weaknesses, fix them, and report incidents and suspicious access attempts to regulators quickly.

Only 5 of 28 virtual-asset service providers (VASPs), all exchanges that trade against the won, are members of the Financial Security Institute (FSI), the financial sector’s security agency, the FSC said. It wants the rest to join, and the FSI plans exchange-specific security checks within the year.

The draft Digital Asset Act will make crypto firms meet the same IT-safety standards as financial companies and be liable for damages, the FSC said.

What we don’t know yet

The FSC has not said what conditions an exchange must meet before freezing on suspicion, how long a freeze may last, or when the letter will be issued. It also has not said when the draft Digital Asset Act will be presented. Yonhap reported that the government bill will be unveiled soon (Korean).

Why it matters: users could see more short, precautionary withdrawal halts at Korean exchanges, and those halts would now have a regulator’s cover rather than a legal grey area.

Next, watch for the text of the no-action letter and the published conditions, and for the draft Digital Asset Act.

This article is for information only and is not investment advice.