South Korea will let crypto exchanges freeze withdrawals when a hack is only suspected

South Korea's Financial Services Commission (FSC) said on November 12, 2026, that it will issue a no-action letter allowing crypto exchanges to suspend deposits and withdrawals when a hack is suspected, not only once one is confirmed, according to a statement in Korean on its website. Once issued, the letter would change when a Korean exchange may stop customers from moving funds.

What the regulator decided

Under South Korea's Virtual Asset User Protection Act, an exchange may not block deposits or withdrawals without a justifiable reason, and the law allows a block when a hack has clearly taken place, the FSC said. Exchanges had been unsure whether they could act earlier, at the stage of suspicion. The no-action letter is meant to remove that doubt: the FSC describes such a letter as a reply from the financial authorities on whether they will take sanctions over conduct a firm intends to carry out.

The release says the suspension will be allowed under certain conditions but does not list them, and it gives no date for the letter. We could not read the files attached to the release: a copy of the release itself and the vice chairman's opening remarks.

The decision was discussed at a security meeting for the industry in Seoul chaired by FSC Vice Chairman Shin Jin-chang. The release lists the Financial Supervisory Service, the Financial Security Institute, the operators of the five exchanges that trade against the Korean won (Dunamu, Bithumb, Coinone, DigitalX, and Streami), four other exchanges, two custodians, and the industry group DAXA as participants.

What else the FSC expects from exchanges

The FSC also set out what it expects from exchanges before any new law passes:

• Round-the-clock monitoring. Under an emergency response guideline that the release says is being prepared, exchanges must keep staff on duty at all hours and apply controls at once when they see abnormal large transactions or signs of an incident. An exchange that cannot do so must process deposits and withdrawals only during the hours when its monitoring is running, and tell users in advance.
• Hot wallets. Balances held in internet-connected wallets should be kept to the minimum needed for trading, and exchanges should consider spreading them across several wallets. The supervisory rule requires 80% of user assets to be kept in offline, or cold, wallets; the FSC said the share across the industry is 95% or more.
• Compensation. Exchanges should hold enough insurance cover and reserves to compensate users after a hack. The release gives no amounts or deadlines.
• Security checks. Of 28 operators, only the five won-market exchanges are members of the Financial Security Institute, the release says. The FSC wants more to join and said the existing security check standard will be improved within the year.

The regulator said it is preparing a Digital Asset Act that would give exchanges information-security duties comparable to those of financial companies and make them liable for damages. Until that law passes, it plans to use guidelines to require duties equivalent to those in the Electronic Financial Transactions Act.

Shin said, in remarks the release paraphrases, that exchanges hold users' assets and need security at the level of traditional financial firms, and that they should act now because legislation takes time.

Why the FSC acted now

The release cites the Binance hack and other recent incidents at exchanges in South Korea and abroad. The decision follows the theft of about $6.3 billion from Binance, which paused withdrawals on October 29.

On November 2 the FSC held an emergency meeting with domestic exchanges, and said it would review easing the rules so that exchanges could quickly restrict withdrawals in emergencies such as a hack at another exchange, Yonhap News Agency reported in a story carried by Financial News.

Two Korean exchanges have suspended services since late October, according to Cointelegraph. GOPAX, operated by Streami, halted trading, deposits, and standard withdrawals on November 6 after a hacking threat, the outlet reported that day, citing the newspaper Kyunghyang Shinmun, and a representative told the newspaper that no hack had occurred at that point. Prabang suspended services on October 24 after abnormal withdrawals from a hot wallet, with reported losses of about $70,000, Cointelegraph said. We have not confirmed those two accounts with the exchanges.

What it could mean for traders

In our assessment, once the letter is issued, a halt on a Korean exchange could come earlier and on weaker evidence than before. A pre-emptive suspension can limit losses if an attack is real. Exchanges already halt after an incident, as when Brazil's Mercado Bitcoin halted deposits and withdrawals after a suspected hack on November 2.

A halt on suspicion also means funds can be locked on a venue during a false alarm, and prices on a venue that has stopped deposits and withdrawals can move away from prices elsewhere because traders cannot move assets in or out to close the gap.

For an exchange that cannot staff monitoring around the clock, the requirement would mean deposits and withdrawals only during the hours it does, with notice to users in advance. Our analysis of exchange risk after the Binance hack covers what a withdrawal pause means for users.

What happens next

The release does not say when the FSC will issue the no-action letter or publish its conditions. The Digital Asset Act is still being prepared, and the release gives no date for it.