South Korea's FSC calls in crypto exchanges after Binance hack, urges more cold storage

South Korea's Financial Services Commission (FSC) summoned the country's crypto exchanges on Nov. 2, three days after the Binance hack. The FSC said Yoo Young-joon, its director general for digital finance policy, chaired an emergency review meeting with the Financial Supervisory Service (FSS), the Financial Security Institute, the Digital Asset eXchange Alliance (DAXA) — a joint body of Korean crypto exchanges — and major virtual asset service providers. Officials reviewed the exchanges' cold wallet (wallets kept offline) holdings and the status of their insurance coverage and reserves, and urged them to raise cold wallet ratios and build up more reserves.

As of 5:30 p.m. KST on Nov. 2, bitcoin traded at 105,184,000 won on Upbit. Binance's price at the same time was $78,227, putting the kimchi premium (the gap between prices on Korean exchanges and global markets) at about 0.9%. The FSC said the meeting also reviewed the Binance incident's impact on the Korean crypto market but did not release the findings.

From a work laptop to the signing system

Binance said about $6.3 billion, or roughly 8 trillion won, in crypto was taken without authorization from its hot wallet (an internet-connected wallet used for withdrawals) on Oct. 30 KST. Binance said it was tracing and freezing the stolen assets after the incident and would cover all user losses with company funds and other resources.

The FSC said the main suspected causes being raised were access to internal systems through a compromised employee work laptop and unauthorized access to the transaction approval and signing system that allowed the assets to be withdrawn.

At the meeting, the FSC said, officials focused on Korean firms' access controls on their IT systems, the approval and signing processes for withdrawals from hot wallets and other wallets, and how administrator privileges are managed.

Four steps firms can take now

The FSC asked firms to take security measures they can put in place right away to prevent similar breaches. It requested the following four steps.

• Raise the share of assets held in cold wallets
• Monitor deposits and withdrawals around the clock and add response staff
• Run a rapid response system for reporting and sharing abnormal access attempts
• Set aside additional reserves

The FSC said it would keep strengthening its response system in close cooperation with related agencies and the industry to prevent further breaches such as hacks and keep damage from spreading. The release did not name the exchanges that attended, give each firm's review results or specify how much more in reserves firms should set aside.

The legal bar: 80% and 5%

Korean exchanges already face legal wallet storage requirements. The Virtual Asset User Protection Act, which took effect on July 19, 2024, requires firms to keep at least a set share of users' crypto in cold wallets. Under the draft enforcement decree and supervisory regulations the FSC released in December 2023, that share was set at 80% of the economic value of users' crypto. That is higher than the previous standard of 70% of total holdings by quantity, and exchanges must calculate the value of user assets every month and keep at least 80% in cold wallets.

Firms must also set aside funds against hacks and system failures. The draft rules require them to buy insurance with coverage of at least 5% of the economic value of crypto held in hot wallets, or to hold the same amount in reserves. The minimum is 3 billion won for exchanges with Korean won markets and 500 million won for coin-only exchanges and wallet and custody providers.

Upbit's hot wallet was breached a year ago

Korean exchanges have had hot wallet incidents of their own. Upbit said that at around 4:42 a.m. KST on Nov. 27, 2025, about 44.5 billion won worth of Solana-network assets were sent to an external wallet it had not designated. Twenty-four assets were affected, including Solana, USD Coin (USDC), Bonk and Jupiter. Upbit said the withdrawals came from a hot wallet it operated and that its cold wallets were not breached.

In an apology the next day, Oh Kyung-suk, CEO of Upbit operator Dunamu, said member losses totaled about 38.6 billion won and company losses about 5.9 billion won, and that about 2.3 billion won of the member losses had been frozen. He said Upbit had fully covered member losses with its own assets. Oh said the company had found and fixed a security flaw that could have allowed private keys (the passwords that control a wallet) to be inferred by analyzing Upbit wallet transactions recorded on the blockchain.