South Korea’s Financial Services Commission called the country’s main crypto exchanges to an emergency meeting on Monday and asked them to raise their cold wallet ratios, keep a constant watch on deposits and withdrawals, and set aside extra reserves. The regulator said the review was prompted by last week’s $6.3 billion theft from Binance’s hot wallets, and that it focused on the weak points that attack exposed: access to internal systems, withdrawal approval and signing, and administrator privileges.
The meeting was chaired by Yoo Young-jun, the FSC’s director general for digital finance policy. The Financial Supervisory Service, the Financial Security Institute, the exchange body DAXA and the major exchanges attended. Upbit, Bithumb and Coinone were among them, according to Seoul Shinmun.
What the FSC asked for
The commission listed four steps it wants taken now. Exchanges should move a larger share of customer assets into cold wallets, which are kept offline. They should monitor deposits and withdrawals around the clock and add response staff. Abnormal access attempts should be reported and shared quickly. And they should take security measures that can be put in place straight away, including topping up reserves.
Seoul Shinmun reported one further request. The FSC wants closer monitoring of wallet addresses and transactions linked to the hack, with suspicious transfers blocked quickly.
The FSC tied the review directly to what is known about the Binance breach. Its release said the main suspected cause was access to internal systems through an employee’s work laptop, along with possible unauthorized access to the systems that approve and sign transactions. US authorities have since attributed the attack to North Korea’s TraderTraitor group.
Where Korean exchanges stand on cold storage
Korea’s Virtual Asset User Protection Act already requires exchanges to hold at least 80% of customer crypto in cold storage. All five won-based exchanges clear that floor, but by very different margins. Figures from the Financial Supervisory Service as of the end of September, obtained by Democratic Party lawmaker Min Byung-deok and reported by NewDaily, show:
- Upbit: 99.17% in cold wallets
- Bithumb: 94.76%
- Coinone: 85.0%
- DigitalX: 82.79%
- Gopax: 80.54%
Turned around, those figures show how much of each exchange’s customer crypto sits in internet-connected wallets. Upbit keeps less than 1% online. Coinone keeps 15% and Gopax almost 19.5%. As a share of its own customer holdings, Gopax keeps more than 20 times as much online as Upbit. Seoul Shinmun read Monday’s request partly as a push on the exchanges closest to the legal minimum.
Cold storage is not the whole defence. The Binance attackers are suspected of going after the signing systems that move funds between wallets, not the stored keys alone. That is why the FSC also asked about approval chains and admin rights.
Reserves are thin next to a Binance-sized loss
Korean exchanges must buy insurance or hold reserves against hacks and outages. The combined cover must be at least 5% of the value of customer assets held outside cold storage, with a floor of 3 billion won for won-based exchanges. At the end of September, the five exchanges together held 185.4 billion won. Upbit had 80 billion won, Bithumb 53.4 billion, Coinone 30 billion and DigitalX 19 billion. Gopax operator Streami relies on an insurance policy that pays up to 3 billion won.
Those sums are built to cover the hot-wallet slice, not a breach on Binance’s scale. Binance covered the shortfall with its SAFU fund and company money. The stolen $6.3 billion equalled about 3.7% of the $171 billion in total assets Binance held on Oct. 28, based on the asset figure cited by Seoul Shinmun.
Korea has its own record of hot-wallet thefts
The country’s largest exchange has been hit this way twice. In November 2025, Upbit operator Dunamu reported that 44.5 billion won of Solana-network assets were moved from a hot wallet to an unauthorized address. The company said it would cover the loss from its own assets, Yonhap reported. Authorities suspected the Lazarus Group, which was also blamed for the theft of 58 billion won in ether from Upbit in 2019.
The latest incidents are smaller but recent. Last month an outsider got into Bithumb’s mobile groupware and exposed personal data of 844 customers, including resident registration numbers and ID copies. NewDaily also reported abnormal access to some Gopax accounts. Prabang, a smaller coin-to-coin exchange, suspended service after losing about 100 million won of customer assets. The breach comes as Bithumb works toward the 2028 listing it announced in August.
What comes next
Monday’s meeting builds on one held Oct. 28. At that meeting the FSC said it would supervise exchanges to make sure victims of breaches are fully compensated. It also said it would push bank-level security rules onto crypto firms, which fall outside the Electronic Financial Transactions Act. Hwang Hyun-il, a lawyer at Shin & Kim, told NewDaily that the pending Digital Asset Basic Act would be a natural place for user-protection and IT-security duties. The FSC said it will keep tightening its response with other agencies and the industry. It did not set a new legal cold-storage minimum or a deadline.
FAQ
What is the legal cold wallet minimum for Korean exchanges?
At least 80% of customer crypto must be kept in cold storage under the Virtual Asset User Protection Act. On Monday the FSC asked exchanges to go beyond that but did not change the rule.
Which exchange has the lowest cold wallet ratio?
Gopax, at 80.54% at the end of September, according to FSS data reported by NewDaily. DigitalX was next at 82.79%.
How much reserve cover do Korean exchanges hold?
The five won-based exchanges held a combined 185.4 billion won in insurance and reserves at the end of September, led by Upbit with 80 billion won.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
