South Korea Tells Crypto Exchanges to Adopt Emergency Security Rules and Will Let Them Freeze Withdrawals When a Hack Is Suspected

South Korea's Financial Services Commission (FSC) told the country's virtual asset service providers on 12 November 2026 to put in place an emergency security guideline without waiting for new legislation, covering round-the-clock monitoring, minimal hot-wallet balances, larger insurance cover and reserves, and breach reporting at the level expected of banks. The FSC also said it will issue a no-action letter allowing exchanges to block deposits and withdrawals pre-emptively when a hack is suspected, something the current law permits only once a hack is evident, and that it will push all crypto businesses to join the Financial Security Institute and undergo security inspections.

The measures were set out at a virtual asset sector security meeting chaired by FSC Vice Chairman Shin Jin-chang at the Government Complex Seoul, attended by the Financial Supervisory Service (FSS), the Financial Security Institute, the won-market exchanges including Dunamu, Bithumb, Coinone and Streami, coin-market exchanges, the custodians KODA and KDAC, and the exchange alliance DAXA. The FSC distributed its press release on the morning of 12 November for publication on 13 November. It follows the FSC's 5 November order for security inspections at about 580 financial firms, including crypto exchanges.

What the Emergency Guideline Asks of Exchanges

According to the FSC, the guideline is meant to cover what crypto firms can do now to prevent breaches and limit damage, in response to new threats such as AI-assisted cyberattacks. First, because crypto trades 24 hours a day, seven days a week, firms must staff a permanent monitoring and response function and immediately apply controls when an incident is suspected, such as abnormal large transactions. A firm that cannot run such a function around the clock may process deposits and withdrawals only during the hours when it does operate, must tell users in advance, and must still handle withdrawal requests in a timely way.

Second, firms should keep as much customer crypto as possible in cold wallets, which are kept offline. The Virtual Asset Business Supervision Regulation already requires at least 80% of customer assets to be held in cold storage, and the FSC said the sector as a whole holds more than 95%. Even so, it said firms should keep only the minimum needed for trading in hot wallets, consider splitting that balance across several hot wallets, and hold enough insurance cover and reserves to compensate users if a hack causes losses.

Third, the FSC set out IT safety steps modelled on those that the Electronic Financial Transactions Act imposes on financial companies, which do not currently apply to crypto exchanges. Firms must adopt safety standards for the people, facilities and technical, administrative and physical measures behind electronic crypto transactions, analyse and assess vulnerabilities in their systems and networks and fix what they find, and report quickly to the financial authorities whenever a breach occurs or abnormal outside access attempts are detected. Vice Chairman Shin said some firms' approach to security was still stuck at the stage before the sector was regulated, and asked them to act immediately on 24-hour monitoring and reporting, a higher cold-wallet share and larger reserves.

Pre-Emptive Withdrawal Blocks and Financial Security Institute Checks

The Virtual Asset User Protection Act bars exchanges from blocking customer deposits and withdrawals without a justifiable reason and allows a block only where a hacking incident is evident. The FSC said the industry had argued it was unclear whether a block is allowed at the earlier stage, when unusual transactions point to a possible hack. Citing cases such as the Binance hack, the FSC said speed is decisive in limiting user losses, and decided to issue a no-action letter so that exchanges can block deposits and withdrawals pre-emptively, under certain conditions, when a hack or breach is suspected. The release does not list those conditions or give a date for the letter.

Only 5 of Korea's 28 virtual asset service providers, the won-market exchanges, are currently members of the Financial Security Institute, the body that provides security services to Korean financial firms,. The FSC will push the remaining firms to join, taking their size into account; members will receive threat-information sharing, vulnerability checks and security training, while firms that cannot join will get support at the level offered to small financial companies. Crypto firms are not subject to the vulnerability assessments of the Electronic Financial Transactions Act and, apart from ISMS certification under the Act on Reporting and Using Specified Financial Transaction Information, have no separate inspection duty. The Institute will therefore inspect its crypto members, and firms it cannot inspect will be able to check themselves or use security specialists against a new exchange-specific inspection standard covering compliance, blockchain, wallets and smart contracts that is to be revised within 2026.

What Comes Next

The FSC said the Digital Asset Act it is preparing will require digital asset business operators, the term the bill uses for today's virtual asset service providers, to meet IT safety obligations equivalent to those of financial companies and to bear liability for damages. Because the legislation will take time, the guideline is intended to apply comparable obligations in the meantime. The FSC said it will support the industry's security overhaul and keep revising the rules.

For exchanges and custodians in Korea, the immediate points are to align withdrawal processing with real monitoring hours and tell users, review hot-wallet balances, insurance limits and reserves, prepare to report incidents and suspicious access attempts, and expect a Financial Security Institute membership request and an updated inspection standard before year-end.