South Korea Will Let Exchanges Freeze Withdrawals on a Suspected Hack, FSC Says

Published November 12, 2026, 1:15 PM PKT. Based on the Financial Services Commission announcement on November 12, 2026 (primary source), reporting by crypto.news and BeInCrypto on November 12, 2026, and reporting by Coinotag and KuCoin News (secondary sources). The no-action letter has been announced but its full text and exact conditions have not been published in English.

South Korea will let cryptocurrency exchanges freeze customer deposits and withdrawals when a hack is only suspected, not confirmed, a shift that closes a legal gray zone exposed by a string of security scares at Korean trading platforms.

The Financial Services Commission (FSC) said on Thursday, November 12, 2026, that it will issue a no-action letter permitting exchanges to suspend transactions under certain conditions when suspicious activity suggests a possible cyberattack. The decision followed a security meeting in Seoul chaired by FSC Vice Chairman Shin Jin-chang, according to crypto.news. A no-action letter is a written pledge from a regulator not to penalize a practice, and in this case it gives exchanges regulatory assurance for preventive suspensions that meet the specified conditions. It does not give them unrestricted authority to freeze customer funds.

Bitcoin ($BTC) traded near $73,600 on November 12, 2026, little changed on the day, while the FSC announcement landed.

The freeze now allowed on suspicion

Under South Korea's existing Virtual Asset User Protection Act, cryptocurrency exchanges cannot restrict customer deposits and withdrawals without legitimate grounds, and the law permits suspensions only when a hacking incident is clearly established. That left uncertainty over whether an exchange could stop transactions before confirming an attack, particularly when it detected unusual transfers or suspicious account activity.

The FSC said rapid intervention can prevent further losses when an exchange faces a possible security breach. Exchanges had told regulators that halting withdrawals over suspicious activity sat in a legal gray zone, and the no-action letter is the regulator's answer to that complaint, according to BeInCrypto. Officials pointed to Binance as proof that speed decides losses: attackers drained about $6.3 billion from the exchange in late October, a theft the FBI tied to North Korea.

Round-the-clock monitoring, and limits for weaker platforms

The FSC paired the new permission with tougher operational demands. Exchanges must strengthen their monitoring systems and respond more quickly to potential attacks, with continuous monitoring throughout the day to reflect the market's 24-hour trading schedule. Platforms need responsible personnel available to investigate suspicious transactions and take immediate action when unusual activity suggests a security problem.

Platforms unable to maintain round-the-clock monitoring would have to process deposits and withdrawals only during hours when their security teams are available. Affected exchanges would need to inform customers in advance and assign sufficient personnel to handle withdrawal requests promptly.

The regulator also instructed operators to keep more customer assets in offline storage and review their insurance coverage and financial reserves. South Korea currently requires virtual asset service providers to hold at least 80% of customer cryptocurrency in cold wallets, and the FSC said the industry's overall cold-wallet ratio already exceeds 95%, although individual exchanges maintain different proportions. Under the new guidance, exchanges should limit hot-wallet balances to the amounts needed for routine transactions, consider spreading funds across multiple wallets, and maintain sufficient insurance and reserves to compensate customers affected by hacking incidents.

GOPAX and Prabang forced the change

The measures follow a series of security threats affecting South Korean cryptocurrency businesses. On November 6, GOPAX suspended cryptocurrency trading, deposits and standard withdrawals after receiving an email threatening a cyberattack. The exchange began transferring customer assets into cold wallets while investigating the threat, and said it had not detected an actual hacking attempt or cryptocurrency theft. Customers could request withdrawals through support channels, although each request required manual verification.

On October 24, another South Korean exchange, Prabang, suspended operations after detecting abnormal withdrawals from its hot wallet. The platform reported losses of approximately $70,000 and said it would compensate affected customers using company funds. Bithumb, one of Korea's largest exchanges, also disclosed a personal data leak from an internal mobile system in late October, according to BeInCrypto.

At the November 12 meeting, Shin said virtual asset companies should maintain security standards comparable to traditional financial institutions because they store and manage customer assets.

The watchdog that was breached itself

The FSC also wants all 28 registered virtual asset service providers inside the Financial Security Institute (FSI), the sector's state-run cyber auditor, which offers threat intelligence, vulnerability assessments and specialist training. Currently, only five won-market exchanges among the 28 registered providers have joined the institute.

That push comes at an awkward moment. On Monday, the FSI confirmed hackers had broken into the online portal that financial firms use to submit security-audit paperwork. The stolen files may include those firms' own answers to FSI security assessments. The FSI said the portal sits outside its core network, and regulators are still checking what was taken, according to BeInCrypto.

A review published in October found cybersecurity weaknesses at 130 of 555 financial entities examined nationwide, and the FSC separately named GOPAX operator Streami and Prabang among 16 organizations tied to earlier security incidents. The institute will update its security inspection standards by the end of 2026, covering transaction verification, wallet access controls, blockchain systems and smart contracts.

What to watch next

Three things decide how this plays out. The first is the no-action letter itself: its full text and the specified conditions will show exactly when a preventive freeze is protected and for how long one can last. The second is the proposed Digital Assets Act, which would impose bank-grade IT duties and damage liability on exchanges, and on which lasting rules depend. Until it passes, Seoul is regulating by guideline, leaning on a security partner that is still investigating its own breach. The third is enforcement: whether exchanges report suspected breaches and unusual external access attempts promptly, as the FSC now requires, and whether the 23 providers outside the FSI join it or receive similar support.

Sources

• Financial Services Commission, Announcement on preventive withdrawal suspensions and exchange security measures, November 12, 2026 (primary source: no-action letter permitting exchanges to suspend transactions under certain conditions when suspicious activity suggests a possible cyberattack; decision followed a security meeting chaired by Vice Chairman Shin Jin-chang; continuous monitoring required; cold-wallet and insurance guidance; announcement reported by crypto.news and BeInCrypto)
• crypto.news, South Korea to allow crypto exchanges to block withdrawals if hacks are suspected, November 12, 2026 (secondary source: FSC to issue a no-action letter; Virtual Asset User Protection Act permits suspensions only when a hack is clearly established; 80% cold-storage rule, industry ratio above 95%; GOPAX November 6 suspension after a threat email, no breach detected; Prabang October 24 hot-wallet breach, about $70,000 lost; FSI to expand inspections; only five won-market exchanges among 28 registered providers have joined the FSI)
• BeInCrypto, South Korea Just Changed When Exchanges Can Freeze Your Crypto, November 12, 2026 (secondary source: no-action letter as a written pledge not to penalize preventive freezes; Binance $6.3 billion late-October hack cited by officials, FBI tied it to North Korea; Bithumb personal data leak in late October; FSI portal breach confirmed on Monday, stolen files may include firms' security-assessment answers; Digital Assets Act would impose bank-grade IT duties and damage liability)
• Coinotag, FSC to Let Korean Exchanges Freeze Withdrawals on Hack Suspicions, November 12, 2026 (secondary source: exchanges unable to maintain 24-hour monitoring may process deposits and withdrawals only during staffed hours; letter changes conduct guidance, not the statute; inspection standards due by the end of 2026)
• KuCoin News, South Korea to Allow Crypto Exchange Withdrawals to Be Frozen in Hacks, November 12, 2026 (secondary source: preventive suspensions permitted when hacking is believed to be underway, provided specific conditions are met; Prabang reported about $70,000 in losses)

This article is news reporting and is not investment advice.