• South Korea's Financial Services Commission held an emergency security meeting with exchanges and custody firms.

• The Virtual Asset User Protection Act requires licensed exchanges to keep 80% of customer assets offline.

• Regulators are weighing a cold storage minimum near 99%, a level some large platforms already maintain.

FSC Weighs a 99% Cold Storage Floor

The Financial Services Commission has held an emergency security meeting with South Korea's leading virtual asset exchanges and custody providers to review stronger protection for customer funds after the record breach at Binance. Under the Virtual Asset User Protection Act, which binds every licensed operator in the country, exchanges must store a minimum of 80% of customer assets in cold wallets, storage kept disconnected from the internet, typically a hardware wallet or comparable offline device. The remaining share may sit in hot wallets, where each crypto wallet address is reachable online and funds are positioned to process withdrawals and daily trading. Regulators are now weighing whether to raise the required offline portion close to 99%, a level some of the largest platforms already maintain. Raising the floor would shrink the share of customer funds an online attacker can reach, the stated aim of the review.

The 80% floor balances security against liquidity: assets in cold storage move only after extra approvals and signatures made with the exchange's private key, so the offline share sets how much money is available for instant withdrawals. Hot wallet balances cover outgoing transfers, so any shortfall forces operators to pull funds back from offline storage before a withdrawal clears. The review follows the Binance incident, in which more than $6.3 billion was stolen, the largest crypto hack on record. The FBI has named TraderTraitor, a hacking group linked to North Korea, as the party behind the attack, and North Korea has denied involvement. Kim Yo-jong, a department director at the Workers' Party of Korea's Central Committee, responded that the US accusation was driven by political motives. Officials have also indicated the review extends beyond storage ratios to internal system access controls and transaction approval procedures across the sector. No amendment has been filed so far, and the commission has not set a timeline for a decision.

Bithumb's 13-Hour Withdrawal Delay

A higher offline ratio carries an operational cost that falls unevenly across the market. Smaller exchanges lack the staffing and reserve capacity of the largest platforms, and a 99% requirement would leave them with very little instantly spendable inventory. A sudden surge in withdrawal demand can then outpace what hot wallets hold, forcing operators to pull funds from cold storage before transfers clear. Each move from offline storage triggers a review chain rather than a single automated transfer, which stretches processing times during stressed sessions. South Korea's own trading history offers a precedent: in August, Bithumb, one of the country's largest venues, saw some altcoin withdrawals delayed by roughly 13 hours after a hot wallet shortfall forced additional transfers from cold storage. That episode also revives the older custody debate set out in Crypto Exchange vs Crypto Wallet, since assets left on a platform sit under its full control.

The delay risk matters most when prices move fast. In a market where values can drop sharply within hours, an investor waiting on offline approvals may be unable to exit through spot trading in time, which can deepen losses on a falling position. Regulators reviewing the 99% threshold face this tension directly: more offline protection means less liquidity available exactly when customers need it. Security specialists have also questioned whether storage ratios alone decide safety. Haipo Yang, the founder of the exchange CoinEx, argued that the Binance breach exposed preventable weaknesses rather than an unavoidable failure. He said development and production environments were not fully separated, and that operational systems lacked effective two-factor authentication, so a single compromised key could open a path into the system. He proposed dedicated work devices and authentication built on hardware security keys as alternatives. Yang added that in multisignature arrangements, approvers who do not independently verify each transaction leave the whole system exposed if one node is compromised.

The Compliance Squeeze on Smaller Venues

For COINOTAG's desk, the proposal reads as a squeeze on the middle of the Korean market rather than on its leaders. A 99% rule, if adopted, would bind every operator licensed under the Virtual Asset User Protection Act; until an amendment passes, the existing 80% floor stays the binding standard. The exchanges that already hold 99% offline gain an advantage they meet by default, while mid-sized venues absorb the cost of new reserve and staffing requirements, which could accelerate consolidation toward the largest platforms. Storage ratio is only one variable: the CoinEx founder's critique of access controls and multisignature verification suggests any final package will need to cover internal procedures as well.