South Korea’s Financial Services Commission is preparing to give crypto exchanges more room to act before a hack is confirmed. Under a planned no-action letter, platforms could suspend deposits and withdrawals when they suspect an attack. The regulator said it would not penalize preventive freezes that meet certain conditions. The idea is to move the trigger from a confirmed breach to a suspected one. For exchanges that often have minutes to react, that is a real change. The research findings date the announcement to November 12, 2026.
A lower bar for freezing funds
The practical details are still unclear. The FSC did not spell out the conditions attached to the relief. That matters. A vague definition of suspected hacking could let an exchange freeze user funds for convenience. A very narrow one could make platforms hesitate when speed is most important. The no-action letter is a written promise not to punish a specific behavior, so the fine print may end up doing most of the work.
Two cases pushed the regulator
Two recent incidents appear to have shaped the decision. On November 6, GOPAX suspended operations after receiving a threatening email. It moved assets into cold storage even though no breach had been confirmed. On October 24, Prabang lost about 100 million won, or roughly $70,000, from a hot wallet. The platform said it would compensate affected customers with company funds.
Those cases came during a wider wave. According to the research findings, more than 37 financial firms in South Korea were hit by cyber incidents between late September and early November 2026. Around 473,000 records were exposed, and about 1 billion won was stolen from hot wallets and other targets. The FSC held an emergency meeting on November 2 and has since pressed exchanges to tighten security.
Cold storage and the cost of caution
One measure is already in place: exchanges must keep at least 80% of assets in cold wallets, which are offline and harder to reach remotely. The FSC has called for raising that minimum. That could reduce theft risk, but it may also affect liquidity. More assets offline can mean slower processing for large withdrawals.
The Prabang case raises another question. The exchange covered customer losses itself. Not every smaller platform will have the balance sheet to do that. That is part of why preventing theft matters more than paying people back afterward. Perhaps the regulator will address that gap, though the announcement did not say so.
What to watch
The next step is the fine print. How does the FSC define suspected hacking? How long can a freeze last? And where will any new cold-storage minimum land above 80%? Those answers will decide whether the policy protects users or simply gives exchanges more discretion.
