South Korea to Allow Crypto Withdrawals to Be Frozen in Hack Alerts

South Korea’s Financial Services Commission (FSC) is moving to give crypto exchanges clearer legal grounds to temporarily halt deposits and withdrawals when hacking is suspected, rather than waiting for a confirmed breach. The regulator said it will issue a no-action letter allowing “preventive suspensions” under defined conditions—an approach aimed at reducing the damage that can occur in the early stages of an attack.

According to the FSC, current rules generally bar exchanges from blocking withdrawals without legitimate reasons and only explicitly permit restrictions once a hacking incident is clearly established. The regulator’s plan would shift that framework toward faster response, while still requiring exchanges to follow specific safeguards and notification steps.

Key takeaways

• The FSC plans to allow exchanges to suspend deposits and withdrawals based on suspected hacking, not only after a breach is confirmed.
• The change will come via a no-action letter, designed to clarify how exchanges can act within the existing withdrawal-suspension rules.
• Exchanges would be expected to run continuous monitoring and incident response; if they can’t, they must operate within staffed hours and warn users in advance.
• The FSC is also pressing for stronger security controls, including higher cold-wallet holdings and improved insurance and reserve coverage.

Why the FSC is tightening “suspected hack” procedures

The FSC’s stated rationale is straightforward: in many cyber events, the most valuable window for damage control is early—when indicators suggest an intrusion but verification is still pending. Under the prior framework, exchanges could face uncertainty about whether they are allowed to act quickly if a breach hasn’t been fully proven.

In its announcement, the FSC said it would issue the no-action letter permitting preventive suspensions under certain conditions. In practice, this would create a clearer path for exchanges to stop incoming funds and limit outflows during the critical initial phase of an incident, with the goal of preventing attackers from moving assets before containment is finalized.

Conditions exchanges would need to meet

Beyond the permission to suspend activity, the FSC emphasized operational readiness and user-facing transparency. It called for round-the-clock monitoring and incident response capabilities, along with broader financial and security protections.

Specifically, the regulator said exchanges should maintain higher cold-wallet holdings—an approach intended to reduce the portion of funds exposed to online systems during an attack. It also asked for stronger insurance coverage and reserves, signaling that security measures should be paired with resources to address losses if incidents occur.

The FSC also addressed the practical reality that not all platforms may be staffed or equipped for continuous operation. It said exchanges unable to monitor continuously should process deposits and withdrawals only during staffed hours and notify users in advance—requirements that would limit sudden service interruptions and help users understand when access to funds may be restricted.

Recent incidents appear to have shaped the regulator’s approach

The FSC’s shift comes amid heightened scrutiny following security problems at multiple South Korean platforms.

Earlier coverage from Cointelegraph noted that GOPAX suspended crypto trading, deposits, and “standard withdrawals” after receiving a hacking threat. In that case, a representative said no breach had occurred—illustrating the kind of gray area that the FSC’s preventive-suspension plan is designed to handle. The regulator’s framework would aim to reduce uncertainty for exchanges facing suspected threats before a definitive incident determination is reached.

Another example mentioned by the FSC was Prabang, which suspended services after detecting abnormal hot-wallet withdrawals and reported losses of about $70,000. While the FSC did not expand on the operational details in this announcement, the cited incident reflects the risks associated with compromised or misused hot-wallet access—the area that cold storage and tighter operational controls are meant to mitigate.

Broader cybersecurity findings from the FSC

The preventive-suspension proposal also aligns with the regulator’s wider assessment of cybersecurity across the financial sector. According to the FSC, in October it identified cybersecurity deficiencies at 130 of 555 financial companies reviewed nationwide.

The commission also linked several companies to earlier security incidents, naming GOPAX operator Streami and Prabang among 16 companies involved in such events, as reported in connection with those reviews. This broader context matters for industry participants: the FSC’s preventive-suspension letter is not being presented as a standalone policy, but as part of an expanding enforcement-and-guidance posture focused on readiness, monitoring, and layered defenses.

What this means for exchanges and users

For exchanges, the change potentially reduces a key operational dilemma: whether restrictions triggered by suspicion could expose the platform to regulatory criticism if a breach later proves not to have occurred. By creating a no-action pathway under defined conditions, the FSC is effectively encouraging faster containment actions when warning signs appear—provided exchanges can meet monitoring, security, and notice expectations.

For users, the likely near-term effect is not just a change in rules, but a change in how fast service interruptions could happen during suspicious activity. The requirement to notify users in advance—at least for exchanges that cannot sustain continuous monitoring—suggests the FSC is trying to balance security urgency with transparency, so customers can understand when withdrawal access is restricted and why.

Going forward, the key items readers should watch are how exchanges interpret and implement the FSC’s conditions, especially around continuous monitoring capabilities, cold-wallet allocation, and how insurance and reserve requirements are reflected in day-to-day risk management. It will also be important to see whether the preventive suspension framework leads to fewer asset losses during early-stage incidents, and how regulators and exchanges define the boundary between “suspected” threats and confirmed hacks.