South Korea Announces Planned No-Action Letter for Crypto Exchange Freezes

South Korea’s Financial Services Commission announced on November 12, 2026 that it plans to issue a “no-action letter” allowing crypto exchanges to preemptively freeze deposits and withdrawals when hacking is merely suspected. The letter had not been issued as of the announcement, and its conditions had not been published.

According to the FSC’s announcement, the planned no-action letter would be a written regulatory commitment not to penalize exchanges that halt transactions under defined conditions when they detect signs of a potential attack. The announcement indicates that the planned guidance would shift the trigger from a confirmed breach to reasonable suspicion. For related coverage, see Upbit Lists ETHFI/KRW Pair, Bringing Ether.fi to South Korea.

The policy shift comes against a backdrop of escalating attacks on South Korean financial infrastructure. According to CryptoBriefing, more than 37 financial firms were hit by cyber incidents between late September and early November 2026, exposing approximately 473,000 records and resulting in roughly 1 billion won (about $700,000) in stolen funds. The report said the FSC convened an emergency meeting on November 2, 2026 as the attack volume accelerated. Context on this theme: DeFi Tax-Loss Harvesting Before Year-End 2026 — A Practical Guide.

Two recent incidents illustrated precisely why the old rules were untenable for exchanges trying to protect customers. GOPAX, operated by Streami, suspended operations on November 6, 2026 after receiving a threatening email and moved assets to cold storage, even though no breach had been confirmed at the time. That action existed in a legal grey zone under prior rules, exposing GOPAX to potential regulatory penalties for acting on suspicion alone. More on this in World Data Centre Summit – Vietnam 2026.

The earlier Prabang incident made the cost of inaction concrete. According to KuCoin, South Korean exchange Prabang halted services on October 24, 2026 after detecting abnormal hot wallet withdrawals, losing approximately $70,000 (roughly 100 million won) before the platform could respond. Prabang reportedly pledged to compensate customers from company funds.

FSC Finds Widespread Security Gaps Across Financial Sector

According to the FSC, its sector-wide security audit reviewed 555 financial companies nationwide and found cybersecurity deficiencies at 130 of them, a failure rate of roughly 23% across the sector it oversees.

According to the FSC, Vice Chairman Shin Jin-chang chaired the virtual-asset industry security meeting that produced the planned guidance. The FSC said it is mandating 24/7 monitoring and staffing for all exchanges.

The FSC is also pressing to close the participation gap in the Korea Financial Security Institute. Only 5 of the 28 virtual asset service providers in South Korea are currently Financial Security Institute members, leaving 23 firms without access to bank-level security support, including vulnerability assessments, penetration testing by white-hat hackers, and around-the-clock incident response. The FSC is pushing the remaining 23 to join, but as of the announcement, the gap represents the majority of the domestic crypto industry operating outside the institutional security framework.

India Crypto Research noted on X that after the Upbit hack, regulators could not order compensation under existing rules; the FSC has since been working toward no-fault liability so that exchanges would have to repay users for hacks or outages, in the same way banks do. That regulatory trajectory situates the no-action letter as one piece of a broader liability architecture being assembled in Seoul. For more context on how South Korea has been reworking exchange accountability post-Upbit, the framework changes following that incident are worth reviewing alongside this development.

Cold Wallet Requirements and the Liquidity Tradeoff

According to the FSC’s announced policy, exchanges are required to hold at least 80% of customer assets in cold wallets, and the FSC is pushing to increase that minimum threshold further. Cold wallet concentration reduces the attack surface for hot wallet exploits like the one that hit Prabang, but raising the minimum introduces an underreported operational tension: a higher cold storage ratio means larger legitimate withdrawal requests require manual asset movement from cold to hot wallets, potentially slowing withdrawal processing times during peak demand.

This tension is not addressed in the FSC’s current guidance, and regulators have not publicly specified how they plan to balance enhanced cold storage minimums against user expectations for withdrawal speed. The fine print of the no-action letter, including the precise conditions that qualify as “reasonable suspicion” and any maximum duration for a permissible freeze, had not been published as of the announcement date.

Digital Asset Basic Act Will Codify Broader Liability Standards

The FSC said it plans to include provisions in the upcoming Digital Asset Basic Act requiring virtual asset service providers to meet financial-industry-equivalent stability standards and assume liability for damages caused by hacks or operational failures. That legislation would move crypto exchange obligations from guidance-level policy to statutory law, reducing the reliance on instruments like no-action letters for future regulatory gaps.

The enforcement capacity question is real: with 23 of 28 virtual asset service providers still outside the Financial Security Institute, the FSC’s ability to verify compliance with 24/7 monitoring mandates and cold wallet ratios across the industry is limited by the same institutional coverage gap it is trying to close. South Korea has also seen high-profile lapses extend beyond the crypto sector, as a separate incident involving South Korean prosecutors and Bitcoin illustrated the breadth of digital asset security risk across institutions.

If issued as announced, the no-action letter would remove a legal disincentive for exchanges to act defensively when they detect anomalies. For exchange operators and their liquidity risk functions, the proposed change would be narrow but significant: a written regulatory safe harbor for preemptive freezes could change the decision calculus from “can we do this without being penalized” to “do we have sufficient grounds to trigger the freeze.” The specific criteria defining that threshold remain the critical outstanding variable.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.