South Korea Summons Every Crypto Exchange Security Chief for November 19 Hack Response Meeting

Published November 8, 2026, 08:12 AM PKT. Based on Bytes Europe reporting of November 8, 2026 (primary source), with secondary reporting from Seoul Economic Daily and Crypto Impact Hub, and MABOnChain's earlier coverage of South Korea's exchange security review.

South Korea's Financial Supervisory Service (FSS) will summon the chief information security officers of every registered crypto business in the country for a hacking-incident response meeting on November 19, 2026, after a string of data leaks and asset thefts at domestic exchanges, Bytes Europe reported on November 8. The meeting will bring together the security chiefs of won-market and coin-market exchanges as well as custody providers, and the regulator plans to examine each company's security management and internal controls and to discuss hacking-prevention systems and follow-up measures after incidents.

The summons follows a two-month run of incidents that has put South Korea's exchange sector under the closest scrutiny since the Virtual Asset User Protection Act took effect. Gopax halted all deposits, withdrawals and trading on November 6 after receiving a hacking threat email, Bithumb disclosed a breach of its internal groupware that exposed personal data of 715 employees and 844 customers, and the smaller coin-market exchange Prabang lost about 100 million won, roughly $73,000, in unauthorized withdrawals from an internet-connected hot wallet.

The November 19 meeting: every CISO in the room

According to the crypto industry on November 8, as reported by Bytes Europe, the November 19 meeting will gather the chief information security officers of every crypto asset business registered in South Korea. That covers the five won-market exchanges, Upbit, Bithumb, Coinone, DigitalX and Gopax, as well as coin-market venues and custody providers. The FSS plans to scrutinize each operator's security posture and measures to prevent a recurrence, with security management and internal control operations on the agenda alongside hacking-prevention systems and post-incident follow-up.

The meeting is an FSS initiative, distinct from the Financial Services Commission (FSC) emergency meeting held on November 2, which brought working-level staff from the major exchanges together after the record theft from Binance. The FSS has not published its own public notice of the November 19 meeting as of writing, and the report of the summons comes from industry sources rather than a regulator statement.

Gopax: two leaks, then a full shutdown

Gopax is the most serious case on the agenda. The exchange first detected abnormal access to some accounts in early September, leading to the leak of user and employee personal data, and suffered another leak in October, according to Bytes Europe. On November 6, it suspended all crypto asset deposits, withdrawals and trading after receiving a hacking threat email, and it is now moving all of its holdings into cold wallets disconnected from the internet. Gopax is re-examining the path and cause of the leak from scratch, the report said.

Gopax sits just above the legal floor for cold storage, holding 80.54% of customer crypto offline at the end of September, according to FSS figures reported in early November. The Virtual Asset User Protection Act requires exchanges to keep at least 80% of customer deposits in cold wallets. Upbit, by comparison, held 99.17% offline at the same date, Bithumb 94.76% and Coinone 85%.

Bithumb: 715 employees and 844 customers exposed

At Bithumb, South Korea's second-largest exchange, an attacker breached the company's in-house mobile groupware, Daou Office, in late October, exposing names, contact details and copies of identity documents belonging to 715 employees and 844 customers, according to Bytes Europe. Crypto Impact Hub, which tracked the incident in detail, dated the intrusion to October 27 and said Bithumb filed incident reports with the Korea Internet and Security Agency (KISA) the same day and with the Personal Information Protection Commission the next day. The same tracker reported that personal information tied to 6,444 customers was affected in total, but only 844 customers' data was actually exposed. Bithumb has said the breach hit an internal staff system, not a customer-facing one, and it is working with KISA, the FSS and other relevant bodies on a detailed analysis of how the breach happened and whether there was further damage, while patching Daou Office, the entry point for the attack.

Prabang: $73,000 taken from a hot wallet

The third incident is smaller but, for regulators, the most direct warning about hot wallets. Prabang, a coin-market exchange, had about 100 million won, approximately $73,000, worth of crypto assets taken in unauthorized withdrawals from an internet-connected hot wallet, and the personal data of seven users was confirmed to have leaked as well, according to Bytes Europe. Incident trackers list the exchange's services as suspended.

The wider crackdown: inspections and CEO liability

The November 19 meeting is one step in a wider crackdown. On November 5, the FSC announced a full inspection of internal control operations covering external access points and overall security management across the entire financial industry, including crypto asset businesses and electronic financial service providers, according to Bytes Europe. On November 3, FSS Governor Lee Chan-jin told senior officials the regulator will hold chief executives and other senior managers accountable for the recent string of hacking incidents at brokerages, insurers and other financial companies, the Seoul Economic Daily reported, and the FSS will review every external access point across the financial sector and block external access as a matter of principle until vulnerabilities are resolved. FSS data cited by the governor showed cyberattacks had already struck 16 South Korean financial firms as of October 14.

The industry expects the November 19 meeting to mark the start of full-scale, unannounced inspections by the authorities and a raising of security standards, according to Bytes Europe. The items expected on the inspection list include the share of assets held in cold wallets, access controls for employees and security management of outside contractors.

What to watch next

Three dates will show how the crackdown lands. The first is November 19, when the security chiefs meet and the FSS sets out what it expects from each operator. The second is the outcome of the FSC's full-sector inspection announced on November 5, which covers crypto businesses alongside banks, brokerages and insurers. The third is Gopax: the exchange has given no date for resuming deposits, withdrawals or trading, and its return will be the clearest test of whether the regulator is satisfied with its fixes. MABOnChain will also watch whether the FSS publishes its own account of the November 19 meeting, and whether any exchange faces sanctions for weak controls, a step Governor Lee has said the regulator is prepared to take.

Sources

• Bytes Europe (BigGo Finance), South Korea's FSS Summons CISO from Every Crypto Exchange After String of Hacks, Response Meeting Set for Nov. 19, November 8, 2026 (primary source: the Financial Supervisory Service will hold a hacking-incident response meeting on November 19 with the chief information security officers of every crypto asset business registered in South Korea, including won-market and coin-market exchanges and custody providers, to examine security management and internal control operations and discuss hacking-prevention systems and post-incident follow-up; Gopax detected abnormal access in early September with a further leak in October and suspended all deposits, withdrawals and trading on November 6 after a hacking threat email; the Bithumb Daou Office breach exposed core information of 715 employees and 844 customers; Prabang lost about 100 million won, approximately $73,000, in unauthorized withdrawals from a hot wallet with seven users' personal data leaked; the FSC announced a full inspection of internal control operations across the financial industry on November 5; the industry expects the meeting to mark the start of full-scale, unannounced inspections)
• Seoul Economic Daily, Korea Watchdog Warns CEOs Will Be Held Liable for Financial Hacks, November 3, 2026 (secondary reporting: FSS Governor Lee Chan-jin said the regulator will hold chief executives and other senior managers accountable for the recent string of hacking incidents, will review every external access point across the financial sector, will block external access as a matter of principle until vulnerabilities are resolved, and plans a dedicated security unit with more IT specialists; cyberattacks had struck 16 South Korean financial firms as of October 14)
• Crypto Impact Hub, Bithumb Breach: 844 Customers Hit, Regulators Move In (secondary reporting: the intrusion into Bithumb's internal mobile groupware ran on October 27, Bithumb filed with the Korea Internet and Security Agency the same day and with the Personal Information Protection Commission on October 28, personal information tied to 6,444 customers was affected in total with 844 customers' data actually exposed, and the breach hit DaouOffice, an internal staff system, not a customer-facing one)
• MABOnChain, South Korea Orders Emergency Checks of Crypto Exchanges After Binance Hack, Urges Bigger Cold Wallets, November 2, 2026 (context: the FSC emergency meeting of November 2, chaired by Digital Finance Policy Officer Yoo Young-jun, urged exchanges to raise cold wallet ratios; FSS figures put Upbit at 99.17% in cold wallets, Bithumb at 94.76%, Coinone at 85%, DigitalX at 82.79% and Gopax at 80.54%, against an 80% legal floor; the trigger was the October 29 theft of about $6.3 billion from Binance, which the FBI attributed to North Korea's TraderTraitor group)
• MABOnChain, GOPAX Halts Trading and Withdrawals After Hack Threat, Moves All Crypto to Cold Storage, November 7, 2026 (context: Gopax suspended trading, deposits and standard withdrawals on November 6, 2026 after receiving an email threatening a hack, and said it would move all customer crypto to cold storage)

This article is news reporting and is not investment advice.