South Korea’s Financial Services Commission (FSC) says it is preparing new flexibility for crypto exchanges to protect customer funds in the early stages of a suspected attack. Instead of waiting for a confirmed breach, the regulator plans to allow “preventive” suspensions of deposits and withdrawals when hacking is believed to be underway—provided specific conditions are met.

In a statement released Thursday, the FSC said it will issue a no-action letter that permits exchanges to temporarily halt transactions under defined circumstances. The regulator’s aim is to close a practical gap between what exchanges are legally allowed to do now and what incident response teams may need to do immediately when unusual activity suggests an intrusion.

Key takeaways

The FSC plans a no-action framework that allows exchanges to suspend deposits and withdrawals when hacking is suspected, not only when a breach is proven.
Current rules require legitimate grounds and restrict withdrawal limits to cases where a hacking incident is clearly established.
The FSC is pairing the policy shift with operational security demands, including continuous monitoring and stronger cold-wallet practices.
Exchanges that cannot monitor 24/7 would have to limit transaction processing to staffed hours and notify users in advance.

Why the FSC wants “suspected hacking” to trigger action

Under South Korea’s current approach, exchanges are prohibited from blocking withdrawals unless they have legitimate grounds, and restrictions are explicitly tied to situations where a hacking event is clearly established. The FSC’s proposed change effectively updates that standard by recognizing that waiting for full confirmation can be too slow when funds could be moving in real time.

By issuing a no-action letter, the regulator is signaling that it will not take enforcement action against exchanges that temporarily suspend certain user transaction flows as part of an incident response strategy—so long as the preventive step fits within the letter’s “certain conditions,” as described by the FSC.

The regulator also framed the change as part of a broader push for stronger security practices across the industry, indicating that policy alone is not the solution if exchanges lack the operational capability to detect and respond quickly.

New security expectations: monitoring, custody, and coverage

The FSC’s statement did not stop at transaction halts. It also laid out expectations intended to reduce the likelihood of losses and limit damage if an incident occurs.

Among the requirements and recommendations mentioned are:

Round-the-clock monitoring and incident response, reflecting the real-time nature of many attacks.
Higher cold-wallet holdings, which generally reduces the amount of assets exposed to hot-wallet compromise.
Stronger insurance coverage and reserves, aimed at improving financial protection for users and the exchange’s ability to manage losses.

Recognizing that not every operator may be able to run full coverage at all times, the FSC said exchanges that cannot continuously monitor would need to process deposits and withdrawals only during staffed hours and provide advance notifications to users.

Recent South Korean incidents underscore the regulator’s timing

The FSC’s shift comes after several security disruptions involving South Korean exchanges, including cases where threat signals appeared before a breach was fully confirmed.

Earlier coverage from Cointelegraph noted that GOPAX suspended crypto trading, deposits, and standard withdrawals after receiving a hacking threat, while a representative said that no breach had occurred. The decision highlights a common operational challenge: if an exchange reacts only after a breach is definitively proven, it may be reacting too late to prevent asset movement.

Another example cited in the FSC’s context involves Prabang. The platform reportedly suspended services after detecting abnormal hot-wallet withdrawals, and it reported about $70,000 in losses, according to the details referenced alongside the FSC’s statement.

Separately, Cointelegraph also reported that the FSC identified cybersecurity deficiencies at 130 of 555 financial companies reviewed nationwide, illustrating that the regulator’s attention is not limited to exchanges alone.

Within that broader review, the regulator also identified GOPAX operator Streami and Prabang among 16 companies involved in earlier security incidents—adding weight to the case that the current regulatory model and industry safeguards were not keeping pace with the threat environment.

What exchanges and users should watch next

The practical impact of the FSC’s no-action letter will depend on how the “certain conditions” are defined and implemented in guidance, and on whether the policy is matched by consistent enforcement elsewhere in the system. For exchanges, the biggest near-term question is operational: can they meet the monitoring and custody expectations without creating unnecessary disruptions?

For users, the key point is that suspensions may become more likely in the immediate aftermath of suspicious activity—not just after a breach is verified. The remaining uncertainty is how quickly exchanges will communicate with customers during preventive pauses and whether the additional requirements around monitoring, reserves, and insurance will prove sufficient to reduce losses when threats materialize.