Previously in South Korea, an exchange had to prove it had actually been hacked before it could suspend deposits and withdrawals. Starting today, the order is reversed.
On November 12, Shin Jin-chang, Vice Chairman of South Korea’s Financial Services Commission (FSC), chaired a meeting on security measures for the virtual asset industry and decided on several measures:
1) Issue a “no-action letter”: Under certain conditions, exchanges can suspend deposits and withdrawals preemptively as soon as they suspect a hack or intrusion—for example, if unusual trading activity occurs—without waiting for an incident to be confirmed. The current Virtual Asset User Protection Act stipulates that deposits and withdrawals must not be blocked without just cause, and allows it only when a hacking incident has clearly occurred.
2) 24/7 monitoring: Staff must be on duty at all times and respond immediately to unusually large transactions. Platforms that cannot provide round-the-clock monitoring may process deposits and withdrawals only during staffed hours, and must inform users in advance.
3) Maximize the cold-wallet share: The regulatory requirement is 80%, while the industry-wide figure is already above 95%. Keep only the minimum amount needed for trading in hot wallets; consider spreading it across multiple hot wallets. Also increase insurance coverage limits and reserves.
4) Of the 28 virtual asset service providers, only five—those operating Korean won markets—have joined the Financial Security Institute so far. The others will be encouraged to join.
The backdrop is a turbulent spell in South Korea: GOPAX suspended trading and deposits and withdrawals after receiving a hacker threat (the company said there had been no intrusion); personal information belonging to 844 Bithumb users was leaked; and about 100 million won was stolen from Prabang’s hot wallet. Looking further ahead, the Digital Asset Act would impose IT security obligations and compensation liabilities on exchanges equivalent to those of financial institutions.
My take: this legalizes “pulling the plug first.” It’s a double-edged sword for users—if something really goes wrong, you lose less; if there’s a false alarm, you may not be able to withdraw your $BTC at the very moment you most want to. Whether the rules are any good depends on how that phrase “under certain conditions” is ultimately written.
In a nutshell: exchange security standards are shifting from those of internet companies toward those of banks.
Sources: press releases from South Korea’s Financial Services Commission, Yonhap News Agency, Financial News, and Cointelegraph (November 12). This is not investment advice.