Gopax Halts Trading After Hack Threat: What India Must Know

On 6 November 2026, a South Korean crypto exchange called Gopax did something no exchange does lightly: it stopped everything. Deposits, standard withdrawals and trading were all suspended, outstanding orders were cancelled, and the exchange began moving its crypto holdings into wallets that are physically disconnected from the internet. No hack had taken place. No money had been stolen. The trigger was a single email threatening a hacking attack.

Within two days, South Korea's financial regulators had responded at full scale. The Financial Services Commission announced a full inspection of security controls across the financial sector, and the Financial Supervisory Service summoned the chief information security officer of every registered crypto business in the country to an emergency meeting on 19 November. This guide explains what happened at Gopax, why Korean regulators moved so fast, what South Korea's cold-storage law actually requires, and what Indian crypto users should take away from it.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose. This guide explains a security incident and a regulatory response; it does not recommend any coin, exchange or trade.

What Happened at Gopax on 6 November

Gopax is a South Korean cryptocurrency exchange operated by a company called Streami. It is a won-market exchange, which means its customers trade crypto against the Korean won. It is not one of the country's biggest exchanges — that role belongs to Upbit and Bithumb — but it is a registered, regulated business, and its shutdown was total.

According to the exchange's own notices, reported by FinanceFeeds and crypto.news, the sequence on 6 November was:

Time (6 November 2026)	What Gopax did
2:55 p.m. Korean time (5:55 a.m. UTC)	Deposits and standard withdrawals suspended
3:53 p.m. Korean time (6:53 a.m. UTC)	Trading suspended; all outstanding unfilled orders cancelled
Same day	Exchange begins moving all crypto holdings into offline cold wallets

The trigger, as a Gopax representative told the Korean newspaper Kyunghyang Shinmun, was an email from an individual claiming to be a hacker and threatening a cyberattack. The company stressed that it had not verified the authenticity of the sender's claims, and that no actual hacking incident or attempted theft had been detected when services stopped. No customer losses have been reported.

The exchange described the shutdown as a preventive measure: while trading is halted, it is transferring its cryptocurrency holdings into cold wallets — wallets kept offline, where no remote attacker can reach them. Gopax has not said when normal deposits, withdrawals or trading will resume, and has said the transfer may take longer than usual. Another Korean exchange, Coinone, warned its own customers on 6 November against sending crypto to Gopax, because incoming transfers might not be credited normally while the halt lasts.

Why One Threat Email Was Enough

To understand why a single unverified threat email could freeze an entire exchange, you need the backstory — and Gopax's own recent history.

In early September 2026, Gopax detected abnormal access to some user accounts, which led to the leak of personal information belonging to seven users and two former and current employees. Another information leak followed in October. The exchange has not established any connection between those leaks and the threatening email, but the pattern matters: a platform that has already leaked customer data twice in two months cannot afford to treat a hacking threat as a bluff.

Gopax was not the only Korean exchange in trouble. In late October, Bithumb — one of South Korea's two largest exchanges — suffered a breach of its in-house mobile groupware system, Daou Office, which exposed core information including names, contact details and copies of identity documents belonging to 715 employees and 844 customers. Around the same time, a smaller coin-market exchange called Prabang had about 100 million won — roughly $73,000 — taken in unauthorised withdrawals from an internet-connected hot wallet.

And the wider context is the $6.3 billion Binance hot-wallet theft of 29 October 2026, the largest crypto theft on record, which this site has covered in detail. On 2 November, South Korea's Financial Services Commission held an emergency meeting with major domestic exchanges and urged them to increase the proportion of customer assets held in cold storage. Four days later, Gopax received its threat email and shut down. The timing is not a coincidence: the whole Korean industry was already on alert, and Gopax — with two recent leaks behind it — chose the most cautious possible response.

South Korea's 80% Cold-Storage Rule

The detail that has drawn the most attention in the reporting is a single number: 80.54%. That is the share of customer crypto assets that Gopax held offline in cold wallets at the end of September 2026, according to Financial Supervisory Service data. South Korea's Virtual Asset User Protection Act requires exchanges to keep at least 80% of the economic value of customer cryptocurrency in cold storage. Gopax cleared the legal minimum by just 0.54 percentage points.

That narrow margin is now central to the story in two ways. First, it explains why the exchange moved so aggressively: with barely more than the minimum offline, a successful hot-wallet attack could have reached a large share of customer funds. Second, it shows the limit of a minimum standard — clearing a rule by half a percentage point is compliance, but it is not a comfortable safety margin, and Gopax is now moving all of its holdings offline, well beyond what the law requires.

For readers new to the terms, the distinction is simple. A hot wallet is connected to the internet so that an exchange can process withdrawals quickly. That connection is also the attack surface: if hackers reach the hot wallet, they can move funds. A cold wallet is kept offline — on hardware disconnected from any network — so a remote attacker cannot touch it, but moving funds in and out is slower and more manual. Every exchange balances the two. South Korea's law forces the balance heavily toward cold storage. The Gopax episode is now being read in Korea as evidence that even the legal minimum may not be enough comfort when a threat arrives.

The Regulators' Response: Every CISO in the Room

The regulatory reaction has been swift and unusually broad. According to reporting by Bytes Europe and the Korean outlet JKN on 7–8 November:

• The Financial Supervisory Service (FSS) will hold a hacking-incident response meeting on 19 November, bringing together the chief information security officers of every crypto asset business registered in South Korea — won-market exchanges, coin-market exchanges and custody providers alike. The FSS plans to examine each operator's security management and internal control operations, and to discuss hacking-prevention systems and post-incident follow-up.
• The Financial Services Commission (FSC) announced on 5 November a full inspection of internal control operations covering external access points and overall security management across the entire financial industry, including crypto businesses and electronic financial service providers.
• The FSC has also decided to conduct a comprehensive inspection of security practices across approximately 580 companies in all financial sectors, including the virtual-asset industry, covering external touchpoints, authentication and access control.
• The inspections follow a broader review in October that identified cybersecurity deficiencies at 130 institutions out of 555 financial companies examined — and, separately, 40 security breach incidents reported by 37 financial-sector companies between 30 September and 3 November 2026.

The industry expects the 19 November meeting to mark the start of full-scale, unannounced inspections and a raising of security standards across Korean crypto. The message from the authorities is prevention over punishment: operators that do not increase their own security investment should expect higher regulatory compliance costs.

What This Means for Indian Crypto Users

Gopax does not serve Indian customers, and the halt does not touch any Indian user's funds. But the story matters in India for four practical reasons.

First, the same crackdown is already in India. The Gopax halt is part of the same post-Binance enforcement wave that reached India on 4–5 November, when the Enforcement Directorate searched premises linked to CoinDCX and Delta Exchange in Bengaluru over alleged FEMA violations — rupee deposits allegedly converted to USDT and routed to offshore platforms. Around the same time, the RBI and the Financial Intelligence Unit were reported to be examining offshore prepaid crypto cards used by Indians. When regulators in Korea, the United States and India all move on exchange security and cross-border flows in the same fortnight, it is a global shift, not a local coincidence. Indian users should expect scrutiny of exchanges to keep rising, not fade.

Second, India has no 80% cold-storage rule. South Korea's Virtual Asset User Protection Act sets a hard, checkable number for how much customer crypto must sit offline. India has no equivalent mandate. Indian exchanges are registered with FIU-IND as reporting entities, which covers customer verification, anti-money-laundering checks and reporting — but FIU-IND registration is not a product licence, and it does not, by itself, tell you how much of an exchange's crypto sits in cold storage. Indian users cannot assume their exchange holds the same offline proportion that Korean law demands. If that matters to you, ask the exchange — and check whether it publishes proof of reserves or cold-storage disclosures.

Third, a withdrawal halt is the risk nobody plans for. The Gopax case is a reminder that your funds can be perfectly safe and completely inaccessible at the same time. No money was stolen at Gopax, yet its customers cannot trade or withdraw until the exchange reopens, with no date given. The same pattern appeared in India-adjacent stories this year: Binance paused withdrawals for almost two days after the 29 October hack, and Indian users of offshore crypto cards reported their cards simply stopping in late October. The practical lesson is to keep only trading money on an exchange, and to keep the rest in a wallet you control — a hardware wallet for larger holdings — so that no single platform's freeze can lock up everything you own.

Fourth, the threat-email tactic is now a known play. Gopax received a threat and shut down before any attack was confirmed. That is the cautious outcome. But the same tactic — a menacing email, a fake job interview, a compromised vendor account — has been the opening move in real attacks this year, from the Binance hack's fake recruitment assignment to the SignalPlus incident, where a fake Teams invite sent through a compromised vendor Telegram account led to an engineer's computer being compromised. The lesson for individual users is the same one regulators are now pushing on exchanges: verify before you click, keep API keys restricted and whitelisted where possible, and treat any unexpected message about your exchange account as suspicious until proven otherwise.

What to Watch Next

Four things matter from here. When Gopax reopens is the first: the exchange has given no timetable, and a long halt would itself become a story about how much disruption a precautionary shutdown causes. What the FSS finds on 19 November is the second: the CISO meeting will show whether other Korean exchanges sit as close to the 80% line as Gopax did, and whether the minimum gets raised. Whether the FSC's inspections produce penalties or new rules is the third: unannounced inspections across roughly 580 financial companies could surface problems well beyond crypto. Whether other countries copy Korea's cold-storage model is the fourth: India, which is still shaping its crypto framework, could look at a hard offline-storage percentage as a template — or decide that FIU-IND registration plus exchange disclosures are enough.

There is also a tax point worth repeating for Indian readers. Whatever platform you use, and wherever it is based, your Indian tax obligations do not change. Gains on crypto are taxed at a flat 30% with 1% TDS on sales, and you still need to report the income when you file your return.

Tax note: crypto tax rules can change — the 30% rate and 1% TDS described here were current as of September 2026. Verify the latest rules before filing.

The Bottom Line

On 6 November 2026, South Korea's Gopax exchange suspended all deposits, withdrawals and trading after receiving an email threatening a hacking attack — a precaution, with no intrusion or theft detected, while it moves all customer crypto into offline cold wallets. The exchange had held just 80.54% of customer assets offline at the end of September, barely above South Korea's 80% legal minimum. Within days, the Financial Services Commission ordered a full security inspection across the financial sector and the Financial Supervisory Service summoned every registered crypto business's security chief to a meeting on 19 November.

For Indian users, the direct impact is nil — Gopax does not serve India. The useful lesson is the pattern: exchanges can freeze without being hacked, regulators worldwide are raising the bar on exchange security in the same weeks, and India has no cold-storage rule equivalent to Korea's. Keep trading money on exchanges and the rest in a wallet you control, check your exchange's cold-storage and proof-of-reserves disclosures, and expect the questions about where exchanges keep customer crypto to get sharper, not softer.

Keep Learning

• ED Searches CoinDCX and Delta Exchange Over FEMA Allegations
• SignalPlus Hack: Revoke Your API Keys Now
• Bitget Open Custody Network: Off-Exchange Custody Explained