Key facts
- The FSC said it would issue a no-action letter permitting preventive suspensions under certain conditions.
- Current rules allow exchanges to block withdrawals only when a hacking incident is clearly established.
- The FSC called for round-the-clock monitoring, higher cold-wallet holdings and stronger insurance coverage and reserves.
- Exchanges unable to monitor continuously would process deposits and withdrawals only during staffed hours, the FSC said.
- The FSC identified cybersecurity deficiencies at 130 of 555 financial companies reviewed nationwide in October.
- The FSC named GOPAX operator Streami and Prabang among 16 companies involved in earlier security incidents.
South Korea's Financial Services Commission said on November 12, 2026 that it plans to issue a no-action letter allowing crypto exchanges to suspend deposits and withdrawals when hacking is suspected, rather than waiting until a breach is confirmed. The FSC said it would issue the letter on Thursday, permitting preventive suspensions under certain conditions. Current rules prohibit exchanges from blocking withdrawals without legitimate grounds and explicitly allow restrictions only when a hacking incident is clearly established.
The regulator also called for round-the-clock monitoring and incident response, higher cold-wallet holdings, and stronger insurance coverage and reserves. The FSC said exchanges unable to monitor continuously would process deposits and withdrawals only during staffed hours and notify users in advance.
The move follows recent security incidents involving South Korean exchanges. On Friday, crypto exchange GOPAX suspended trading, deposits and standard withdrawals after receiving a hacking threat, although a representative said no breach had occurred. On October 24, trading platform Prabang suspended services after detecting abnormal hot-wallet withdrawals, reporting about $70,000 in losses.
In October, the FSC identified cybersecurity deficiencies at 130 of 555 financial companies reviewed nationwide. It separately identified GOPAX operator Streami and Prabang among 16 companies involved in earlier security incidents.