$70,000, 130 firms, 28 companies: South Korea changed the rules today—exchanges can freeze your withdrawals based on “suspicion” alone.
#韩国拟准交易所疑遭黑客停充提 South Korea’s Financial Services Commission issued a no-action letter today: from now on, if an exchange suspects a hacking attack, it can suspend deposits and withdrawals immediately, without waiting for the attack to be confirmed. The old rule was the opposite—you couldn’t block withdrawals without a valid reason, and restrictions were only allowed once a hacking incident had been confirmed.
Whether you can withdraw your funds will now depend on three things: whether the exchange is suspicious, whether anyone is on duty, and whether your money is in cold storage.
First, here’s why the rules changed. On October 24, about $70,000 was taken from the hot wallet of the Prabang exchange in an unusual transaction. On November 6, GOPAX received a threatening email from hackers and immediately suspended trading, deposits, and withdrawals, moving all funds into cold storage. It later confirmed that there had been no actual breach. In October, 555 financial institutions nationwide were inspected, and 130 were found to have cybersecurity weaknesses. From late September to early November, more than 37 financial companies were hit by cyberattacks, and the Financial Services Commission even held an emergency meeting on November 2. The old approach was “prove it was hacked first, then take action.” Now it’s “take action first, investigate later.”
Now, what does this mean for those of us who hold crypto? First, there’s a new variable affecting your withdrawals: the exchange’s “suspicion.” A vague signal like “unusual trading activity” could be enough to trigger a freeze, and this announcement didn’t spell out exactly what counts as “specific conditions.” Second, regulators have also imposed strict requirements: exchanges must monitor their systems 24/7, increase the share of funds held in cold storage, and strengthen their insurance and reserves. Exchanges that can’t provide round-the-clock monitoring will only be allowed to process deposits and withdrawals during staffed hours, and they’ll have to notify users in advance. That could mean smaller exchanges will only let you withdraw during the day. Third, don’t focus only on exchanges—the institutions responsible for security have been hacked too. South Korea’s Financial Security Institute confirmed this Monday that its own online portal for receiving security audit documents was breached. Of the 28 registered crypto companies nationwide, only five exchanges that support Korean won trading are currently connected to the Financial Security Institute.
Here’s my take: this new rule is a double-edged sword for users. The upside is that when an exchange really is hacked, it no longer has to go through the “confirm it first” process, which could slow down the theft of funds. The downside is that exchanges get to decide what counts as “suspicious,” and the extent of any freeze depends entirely on their own judgment. If the market takes a big dive and you want to get out, your withdrawals are now more likely to get stuck. I have just one rule for myself: I only keep money on Korean exchanges if I expect to use it soon. Anything I plan to hold long term stays in my own wallet—you can’t predict what an exchange will find “suspicious.”
Which side are you on: would you rather exchanges assume the worst and freeze withdrawals to protect your money, or accept the risk of theft so withdrawals can never be blocked? Regulatory changes like this can change withdrawal rules overnight. Follow me—I’ll keep breaking down what happens next in South Korea and how each exchange puts these rules into practice.
——Bao Bao
#韩国拟准交易所疑遭黑客停充提 South Korea’s Financial Services Commission issued a no-action letter today: from now on, if an exchange suspects a hacking attack, it can suspend deposits and withdrawals immediately, without waiting for the attack to be confirmed. The old rule was the opposite—you couldn’t block withdrawals without a valid reason, and restrictions were only allowed once a hacking incident had been confirmed.
Whether you can withdraw your funds will now depend on three things: whether the exchange is suspicious, whether anyone is on duty, and whether your money is in cold storage.
First, here’s why the rules changed. On October 24, about $70,000 was taken from the hot wallet of the Prabang exchange in an unusual transaction. On November 6, GOPAX received a threatening email from hackers and immediately suspended trading, deposits, and withdrawals, moving all funds into cold storage. It later confirmed that there had been no actual breach. In October, 555 financial institutions nationwide were inspected, and 130 were found to have cybersecurity weaknesses. From late September to early November, more than 37 financial companies were hit by cyberattacks, and the Financial Services Commission even held an emergency meeting on November 2. The old approach was “prove it was hacked first, then take action.” Now it’s “take action first, investigate later.”
Now, what does this mean for those of us who hold crypto? First, there’s a new variable affecting your withdrawals: the exchange’s “suspicion.” A vague signal like “unusual trading activity” could be enough to trigger a freeze, and this announcement didn’t spell out exactly what counts as “specific conditions.” Second, regulators have also imposed strict requirements: exchanges must monitor their systems 24/7, increase the share of funds held in cold storage, and strengthen their insurance and reserves. Exchanges that can’t provide round-the-clock monitoring will only be allowed to process deposits and withdrawals during staffed hours, and they’ll have to notify users in advance. That could mean smaller exchanges will only let you withdraw during the day. Third, don’t focus only on exchanges—the institutions responsible for security have been hacked too. South Korea’s Financial Security Institute confirmed this Monday that its own online portal for receiving security audit documents was breached. Of the 28 registered crypto companies nationwide, only five exchanges that support Korean won trading are currently connected to the Financial Security Institute.
Here’s my take: this new rule is a double-edged sword for users. The upside is that when an exchange really is hacked, it no longer has to go through the “confirm it first” process, which could slow down the theft of funds. The downside is that exchanges get to decide what counts as “suspicious,” and the extent of any freeze depends entirely on their own judgment. If the market takes a big dive and you want to get out, your withdrawals are now more likely to get stuck. I have just one rule for myself: I only keep money on Korean exchanges if I expect to use it soon. Anything I plan to hold long term stays in my own wallet—you can’t predict what an exchange will find “suspicious.”
Which side are you on: would you rather exchanges assume the worst and freeze withdrawals to protect your money, or accept the risk of theft so withdrawals can never be blocked? Regulatory changes like this can change withdrawal rules overnight. Follow me—I’ll keep breaking down what happens next in South Korea and how each exchange puts these rules into practice.
——Bao Bao
