- Trending
- Comments
- Latest
South Korea’s financial regulator is asking crypto exchanges to keep more customer funds offline than the law already requires, after hackers drained $6.3 billion from Binance on October 29.
The Financial Services Commission urged the push at an emergency meeting on November 2, but set no new binding minimum. Exchanges must already hold at least 80% of customer assets in cold wallets.
The FSC convened an emergency meeting with representatives from the Financial Supervisory Service (FSS), Korea Financial Security Institute, Digital Asset Exchange Association (DAXA), and major domestic cryptocurrency exchanges.
The meeting, chaired by digital finance policy official Yoo Young-jun, focused on evaluating potential security vulnerabilities across the country’s virtual asset industry.
Regulators reviewed whether exchanges had adequate controls to prevent unauthorized access to sensitive systems, particularly those responsible for approving and signing cryptocurrency withdrawals.
The assessment followed reports that attackers exploited internal security weaknesses at Binance, allowing them to initiate unauthorized transfers involving approximately $6.3 billion in digital assets.
During the meeting, the FSC urged exchanges to strengthen their use of cold wallets, which store cryptocurrency credentials offline and reduce exposure to internet-based attacks.
Unlike hot wallets, which remain connected to online systems to facilitate deposits, withdrawals, and trading activities, offline storage significantly limits opportunities for remote unauthorized access.
However, cryptocurrency exchanges still require some online infrastructure to process customer transactions efficiently.
This creates a security challenge: platforms must maintain sufficient operational liquidity while limiting the amount of cryptocurrency exposed to potential cyberattacks.
South Korean regulators therefore encouraged companies to increase their offline storage allocations beyond existing minimum requirements.
The FSC also directed operators to review administrator permissions and transaction approval procedures to identify weaknesses that could allow unauthorized withdrawals.
Authorities emphasized that stronger storage policies should operate alongside broader improvements in cybersecurity rather than serve as the only protective measure.
South Korea already maintains mandatory requirements governing the custody of customer cryptocurrency.
Under the Virtual Asset User Protection Act, virtual asset service providers must hold at least 80% of customers’ deposited digital assets in offline storage.
The requirement is designed to limit potential losses if an exchange’s internet-connected systems are compromised.
The remaining portion may support operational activities such as withdrawals and other transactions requiring immediate blockchain access.
Following the Binance incident, regulators urged exchanges to increase their reliance on cold wallets, although the FSC did not announce a new legally binding minimum percentage during the emergency meeting.
The existing 80% threshold therefore remains the applicable requirement.
The law also requires cryptocurrency operators to maintain customer cash deposits at commercial banks, helping separate customer funds from the platforms’ other financial activities.
In addition, exchanges must maintain financial safeguards against operational risks, including insurance coverage, participation in mutual assistance arrangements, or designated financial reserves.
For won-denominated exchanges, the reserve requirement can amount to at least 3 billion South Korean won, approximately $2.2 million.
These measures are intended to provide additional protection for customers when exchanges experience security breaches or other unexpected operational disruptions.
Nevertheless, authorities have stressed that meeting minimum regulatory requirements does not eliminate cybersecurity risks.
An exchange may comply with offline storage rules while still maintaining online infrastructure that could become vulnerable through compromised employee credentials, internal access permissions, or transaction-signing systems.
The FSC’s latest directive therefore encourages companies to assess their actual exposure rather than rely exclusively on compliance with existing numerical thresholds.
For investors, the increased emphasis on offline custody reflects regulators’ efforts to reduce the amount of cryptocurrency potentially accessible during an attack.
The emergency review followed one of the largest reported cryptocurrency security breaches, involving approximately $6.3 billion in digital assets stolen from Binance.
The attack occurred on October 29, with initial reports highlighting the possible compromise of internal systems through an employee’s work laptop.
According to preliminary findings, attackers may have used unauthorized access to interfere with withdrawal approval and transaction-signing processes.
Binance subsequently disclosed additional details suggesting that fraudulent recruitment activities and compromised artificial intelligence tools contributed to the intrusion.
These developments raised concerns about sophisticated cyberattacks targeting employees and internal operational systems rather than relying solely on vulnerabilities in cryptocurrency software.
Hot wallets became a central concern because they support cryptocurrency transfers through systems connected to the internet.
While such systems provide the convenience necessary for active trading platforms, compromised access controls can allow attackers to initiate unauthorized transactions.
The Binance incident demonstrated how quickly cryptocurrency assets can be transferred when attackers gain access to sensitive financial infrastructure.
In response, South Korean authorities focused their review on access permissions, approval procedures, and the controls used to authorize withdrawals.
Regulators also examined the ability of domestic exchanges to identify suspicious activity before significant amounts of cryptocurrency leave their platforms.
Increasing the proportion of funds held in cold wallets could reduce the assets exposed to an online compromise, although it would not automatically prevent attacks involving stolen credentials or weaknesses in internal approval processes.
The FSC therefore emphasized a combination of offline storage and stronger operational security.
The review also reflects concerns about the wider consequences of major cryptocurrency thefts, particularly when stolen assets move quickly through multiple blockchain networks.
Rapid transfers can complicate recovery efforts and require coordination between exchanges, blockchain intelligence companies, and law enforcement authorities.
By strengthening preventive controls, South Korean regulators aim to reduce the likelihood that domestic exchanges experience comparable incidents.
Beyond storage requirements, the FSC instructed cryptocurrency exchanges to strengthen their monitoring and incident-response capabilities.
The regulator called for continuous surveillance of deposits and withdrawals to identify unusual transaction patterns and suspicious activity as quickly as possible.
Exchanges were also urged to deploy additional personnel responsible for responding to cybersecurity incidents.
The measures are intended to improve how rapidly operators detect unauthorized transactions and implement protective action.
Authorities further emphasized the need for clear reporting procedures and timely information sharing between financial regulators and cryptocurrency service providers.
Under the proposed operational improvements, exchanges are expected to maintain effective channels for reporting abnormal access attempts and coordinating responses to potential security threats.
These arrangements could allow regulators and industry participants to react more effectively when suspicious transactions occur across multiple platforms.
The FSC also encouraged companies to strengthen their financial reserves, providing additional resources that may be available if customers suffer losses during a security incident.
The focus on cold wallets forms part of this broader effort to improve resilience across South Korea’s cryptocurrency industry.
Although moving more assets offline can reduce direct exposure to internet-based attacks, monitoring systems and emergency controls remain essential for protecting funds held in active trading infrastructure.
The regulator has indicated that it will continue working with domestic exchanges and international counterparts to prevent further breaches and limit potential financial damage.
South Korea’s approach reflects the increasing importance of cryptocurrency custody standards as the industry confronts more sophisticated cyber threats.
The Binance breach has also prompted wider questions about how exchanges manage operational security, employee access, and financial safeguards.
For domestic operators, the immediate priority is strengthening existing protections while ensuring that customer transactions remain secure and reliable.
As regulators continue reviewing the industry’s security arrangements, greater use of cold wallets and tighter internal controls are expected to remain central to efforts to protect customer assets.
The latest directive underscores South Korea’s determination to reduce cybersecurity exposure before another major cryptocurrency breach threatens investor funds.
Copyright © 2025 - The Bit Gazette.
