The Financial Services Commission has only decided to issue the no-action letter, and has not published the conditions attached to it or set a date. Current law lets an exchange block withdrawals only once a hack has clearly occurred, which is the gap GOPAX fell into when it froze on an emailed threat on November 6.
South Korea's Financial Services Commission has decided to issue a no-action letter that will let crypto exchanges suspend deposits and withdrawals when they suspect a hack, without waiting for one to be confirmed. The decision came out of a security meeting in Seoul on Thursday chaired by Vice Chairman Shin Jin-chang. Cointelegraph, crypto.news and Unchained each read the commission's Korean-language release. The letter itself has not been issued.
The rule it works around sits in the Virtual Asset User Protection Act, which bars an exchange from restricting deposits or withdrawals without a justifiable reason. Unchained's account of the statute says a block is permitted only once a hack has clearly occurred, and that exchanges had told the regulator it was unclear whether anything short of that, an abnormal transaction for instance, gave them cover to act. A no-action letter does not change the statute. It is a regulator's written undertaking not to bring enforcement over a specified practice, which leaves the prohibition in place and makes the assurance contingent on whatever conditions are attached to it.
Those conditions are the missing part. None of the three accounts lists them, because the commission's release does not: it says preventive suspensions would be allowed where specified conditions are met, and leaves them unstated. crypto.news reports the commission's position that the letter would not give exchanges unrestricted authority to freeze customer funds. No issue date has been set.
The case that shows the gap is recent. GOPAX, operated by Streami, halted trading and crypto deposits on November 6 and moved withdrawals to emailed requests approved by hand, after what Yonhap reported was an email from a group claiming to have breached the exchange. GOPAX said it had found no actual hack or theft, and it moved customer assets into cold wallets. Unchained's reading is that the exchange froze on an unconfirmed threat, which is the stage the letter is meant to cover. That is the authors' interpretation, not a commission finding.
A second incident ran the other way. Prabang suspended operations on October 24 after abnormal hot-wallet withdrawals, reporting about $70,000 of losses that it said it would cover from its own funds. Cointelegraph reports that an October commission review found cybersecurity deficiencies at 130 of 555 financial companies examined, and named Streami and Prabang among 16 companies involved in earlier incidents.
The commission's stated reason for moving is the Binance breach. Unchained reports that it cited the hack as evidence that blocking funds quickly is decisive in limiting harm to users, and dates the $6.3 billion hot-wallet loss figure to late October. That is when the loss was quantified rather than when it happened. MiningPool put the figure at $6.34 billion and traced the compromise to a tampered installer that reached Binance's internal wallet signing service four months after the exchange's security team first caught the affected device. Binance set the $6.34 billion aside in late October.
The letter came with operational demands rather than on its own. The commission called for round-the-clock monitoring and incident response, with staff available to investigate and act immediately. An exchange that cannot monitor continuously would have to confine deposits and withdrawals to the hours its systems are staffed, and tell customers those hours in advance. That is a real cost for a smaller operator, and it is the provision most likely to change what a Korean customer can actually do at three in the morning.
On storage the commission asked for more without setting a number. Korean rules already require at least 80% of customer crypto to sit in cold wallets, and the commission puts the industry-wide share above 95%, so the ratio is not the binding constraint. Its guidance is to hold hot-wallet balances down to routine operating needs and spread funds across multiple wallets, which addresses the size of any single exposed pool rather than the proportion held offline.
The move partly reverses the direction Korean policy took in the spring. In April regulators stripped exchanges of discretion over withdrawals, standardizing delays and removing individual exemptions to disrupt voice phishing. That package treated exchange judgment as the problem. This one treats the absence of exchange judgment as the problem, in the narrower case where an exchange believes it is under attack.
Two things remain open. The commission has not issued the letter or published its conditions, so an exchange deciding tonight whether to freeze is in the position it was in last week. And the proposed Digital Assets Act, which crypto.news reports would write cybersecurity obligations into law, carries no date. The Financial Security Institute is to update its inspection standards by the end of 2026, which is the only deadline in the package.
