• The Virtual Asset User Protection Act currently allows suspension only when a hacking incident is clearly established.

• Exchanges unable to maintain 24-hour monitoring may process deposits and withdrawals only during staffed hours.

• South Korea requires at least 80% of customer cryptocurrency in cold storage, and the industry ratio exceeds 95%.

FSC No-Action Letter Opens Door to Preventive Freezes

South Korea's Financial Services Commission said on Thursday it will issue a no-action letter allowing cryptocurrency exchanges to suspend deposits and withdrawals when a hacking attempt is suspected, before any breach is confirmed. The decision came out of a security meeting in Seoul chaired by FSC Vice Chairman Shin Jin-chang, and the regulator set out the plan in an official announcement published the same day.

Under the Virtual Asset User Protection Act, exchanges cannot block customer deposits and withdrawals without legitimate grounds, and the law permits restrictions only when a hacking incident is clearly established. That wording left platforms in a gap: unusual transfers or suspicious account activity often appear before an intrusion is proven, yet acting early carried legal risk. The no-action letter closes that gap by giving regulatory assurance to preventive suspensions that meet specified conditions. It does not hand exchanges unrestricted authority to freeze customer funds.

The FSC paired the change with operational demands. Exchanges should maintain monitoring that matches the market's 24-hour schedule, keep responsible personnel available to investigate suspicious transactions and respond immediately when activity points to a security problem. Platforms that cannot staff round-the-clock oversight would process deposits and withdrawals only during staffed hours, after informing customers in advance and assigning enough personnel to handle withdrawal requests promptly.

Custody rules sit at the center of the package. South Korea already requires virtual asset service providers to keep at least 80% of customer cryptocurrency in a cold wallet, and the FSC put the industry's overall cold-storage ratio above 95%, with individual exchanges holding different proportions. Under the new guidance, operators should cap hot-wallet balances at what routine transactions require, consider spreading funds across multiple wallets, and maintain insurance and reserves sufficient to compensate customers hit by a hack. The regulator also told operators to review their existing insurance coverage and financial reserves.

GOPAX Halt and Prabang Breach Behind the Push

The measures respond to a run of security scares at South Korean venues. On November 6, GOPAX suspended spot trading, deposits and standard withdrawals after receiving an email threatening a cyberattack. The exchange moved customer assets into cold storage while it investigated and said it had not detected an actual hacking attempt or any theft; customers could still request withdrawals through support channels, with each request verified manually.

Prabang's case went further. On October 24, the platform halted services after detecting abnormal withdrawals from its hot wallet, reporting losses of about $70,000 and committing to compensate affected customers from company funds. In an October review of 555 financial companies nationwide, the FSC identified cybersecurity deficiencies at 130, and it separately counted GOPAX operator Streami and Prabang among 16 companies tied to earlier security incidents.

Regulators want the industry's defenses widened. Shin told the meeting that virtual asset companies should hold security standards comparable to traditional financial institutions because they store and manage customer assets. South Korea's Financial Security Institute will expand support for crypto businesses with threat intelligence, vulnerability assessments and specialist training, though only five of the 28 registered virtual asset service providers have joined the institute so far. The FSC plans to encourage more memberships and offer alternative support to operators that cannot join. The institute is set to update its security inspection standards by the end of 2026, covering transaction verification, wallet access controls, blockchain systems and smart contracts, including how platforms protect the private keys behind customer wallets. A proposed Digital Assets Act would go further, requiring crypto businesses to meet IT security standards and carry liability for damages comparable to financial institutions, and the FSC wants suspected breaches and unusual external access attempts reported promptly to financial authorities.

Guidance Now, Binding Law Later

The letter changes conduct guidance, not the statute: the Virtual Asset User Protection Act still requires legitimate grounds for restrictions, and the binding obligations sit in the proposed Digital Assets Act, which has yet to pass. The nearer test is operational. Centralized Korean venues, unlike a DEX, hold direct custody of customer assets, so the staffing rule effectively converts security budgets into trading-hours policy for platforms that cannot monitor continuously. The institute's revised inspection standards, due by the end of 2026, will show whether the 23 non-member operators close that gap or fall behind the five exchanges already inside the framework.