South Korean crypto exchange GOPAX halted deposits and withdrawals at 05:55 UTC on Friday, then stopped trading at 06:53 UTC, after receiving a threatening email from a party claiming a hack. The exchange says it has not verified whether the threat is real, reports no asset loss, and is moving customer crypto into cold wallets. No resume time has been set.
The halt is a precaution, not a confirmed theft. It lands days after South Korea’s Financial Services Commission pressed local exchanges to raise cold-wallet ratios following the late-October Binance theft, and weeks after GOPAX itself disclosed a customer-data leak that the exchange says has not been linked to this email.
What GOPAX told customers
GOPAX’s first Friday notice said deposits and web or app withdrawals were suspended from 05:55 UTC, with withdrawals still available only through a separate request to customer support. A follow-up notice then said trading was paused from 06:53 UTC and that all unfilled orders had been canceled.
Both notices say GOPAX is transferring “all” of its virtual assets into cold wallets disconnected from the internet. English-language coverage from Yonhap said the firm was moving “most” hot-wallet assets; the Korean wire and GOPAX’s own notices use the stronger wording.
The notices frame the freeze as a preemptive security step “in accordance with the financial authorities’ recommendations,” according to GOPAX’s own Korean text. They do not mention the threatening email. That detail came from officials speaking to the press.
Threat received, not verified
Yonhap reported that GOPAX received a threatening email from a group claiming a hack, then stopped deposits and withdrawals and later trading. So far, “no actual asset damage has occurred,” the agency said, in a translation of its Korean wrap.
A GOPAX representative said, according to Yonhap as carried in Financial News English: “We received an email from a group claiming to have carried out a hack, but we have yet to verify whether the threat is real.” The same official added: “Even if this causes inconvenience to users, we are prioritizing the protection of their assets in our response.”
Herald Business quoted a GOPAX official saying: “The timeline for resuming services has not yet been determined.” “We plan to move the assets first and then verify their security.”
Whose decision was the halt?
Accounts differ on how much of the freeze was driven by regulators. GOPAX’s notices cite financial authorities’ recommendations. A GOPAX official later told Etoday the halt was the exchange’s own preemptive decision after the email, not a financial-authorities order, and that the firm then informed the authorities, according to a translation of that interview.
Both lines can sit together loosely. On November 2 the Financial Services Commission held an emergency meeting with domestic virtual-asset service providers and urged higher cold-wallet ratios, tighter withdrawal approvals and closer deposit monitoring after the Binance theft, as we reported in our coverage of the FSC cold-wallet push. That does not mean the FSC ordered GOPAX to halt trading on Friday.
Deposits, peer exchanges and an earlier leak
Deposit status is the messiest point. GOPAX’s first notice still lists deposits as temporarily halted, and as of this check GOPAX has not posted a later notice reopening deposits, withdrawals or trading. Financial News Korean, citing News1, said at about 10:13 UTC that deposits were working again when that article was written. We could not independently confirm live deposit availability from outside the notice board, so treat the current deposit status as unsettled.
Peer exchanges moved faster on the customer side. Coinone warned users that withdrawals from Coinone to GOPAX may not credit normally while GOPAX’s deposit and withdrawal services are paused.
GOPAX had already disclosed an earlier personal-data leak affecting seven customers and two current or former employees, with a further leak confirmed in October. Yonhap and other outlets say any link between that leak and Friday’s threat email has not been confirmed, and that GOPAX currently treats them as separate. We are not asserting a connection.
How this differs from other recent halts
Friday’s freeze looks different from Mercado Bitcoin’s withdrawal halt earlier this week, where a security firm put a dollar figure on a suspected compromise. Here the public record is a threat email of unverified authenticity, official statements that no assets have been lost, and a cold-wallet transfer still under way.
What to watch next
The open items are a resume notice for trading and normal withdrawals, confirmation of whether deposits are open, completion of the cold-wallet transfer, and any finding on whether the email was a real intrusion threat or a bluff. Until GOPAX publishes those updates, the exchange should be treated as partially offline for customers who need to move funds quickly.
FAQ
Was GOPAX hacked? No confirmed hack or asset loss has been reported. GOPAX says it received a threatening email from a party claiming a hack and has not verified whether the threat is real.
Can users still withdraw? Web and app withdrawals are stopped. GOPAX says customers can request a withdrawal through customer support, after which requests are processed manually. No resume time for normal service has been set.
Why move assets to cold wallets? GOPAX says it is transferring all virtual assets into offline cold wallets as a preemptive protection step. English Yonhap described the move as covering most hot-wallet assets; GOPAX’s own notices say all holdings.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
