South Korea Lets Exchanges Freeze Funds on Hack Fears

South Korea's financial regulator has decided that crypto exchanges should be allowed to freeze your money before they can prove they have been hacked. On 12 November 2026, the Financial Services Commission (FSC) said it will issue a no-action letter letting exchanges block deposits and withdrawals when a hack is merely suspected — a sharp change from the current rule, under which an exchange may only restrict withdrawals once a breach has clearly occurred. The decision follows a month of security scares in South Korea's crypto market, and it lands in the same week that India's oldest exchange, Unocoin, suspended all of its services after a security breach. This guide explains what the FSC decided, why the old rule was a problem, what conditions will apply, and what Indian users should take from a foreign regulator's decision.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose. This guide explains a published regulatory decision; it does not recommend buying, selling or holding any asset, and it does not predict where prices will go.

What Happened: The Facts at a Glance

The facts, as reported on 12 November 2026 by Unchained, TheNewsCrypto, blockchainacademics, CoinPost, Coinlab and Basis Desk, are:

• South Korea's Financial Services Commission (FSC) decided on Thursday, 12 November, to issue a no-action letter covering crypto exchanges that block deposits and withdrawals on suspicion of a hack. A no-action letter is a regulator's written assurance that it will not take enforcement action over a specific practice.
• The current rule is the problem. Under South Korea's Virtual Asset User Protection Act, exchanges may not block deposits and withdrawals without a justifiable reason, and a block is permitted only once a hack has clearly occurred. The FSC's letter moves the trigger point from a confirmed breach to a suspected one.
• The letter has not been issued yet. The FSC's release, published in Korean, gives no issue date and says the freezes would be allowed under certain conditions that it did not spell out. Some outlets describe the decision as final; all agree the formal letter and its conditions are still to come.
• The FSC pointed to the Binance hack as the case for acting fast. The late-October 2026 theft of about $6.3 billion from Binance, which the FBI has attributed to North Korea, was cited by the regulator as showing that blocking fast is decisive in limiting harm to users.
• The decision follows a cluster of Korean incidents. Gopax halted trading, deposits and standard withdrawals on 6 November after receiving a hack-threat email, and moved its holdings to cold wallets. Prabang detected abnormal hot-wallet withdrawals on 24 October and suspended services, reporting losses of about 100 million won, roughly $70,000. The FSC held an emergency meeting on 2 November, and in October it found cybersecurity deficiencies at 130 of 555 financial companies it reviewed.
• Tougher security expectations come with the relief. The FSC also called for round-the-clock monitoring and incident response, higher cold-wallet holdings, and stronger insurance coverage and reserves. Exchanges that cannot provide 24-hour monitoring are to restrict deposits and withdrawals to the hours they are actively monitored, and to disclose those schedules publicly in advance.
• Korean rules already require at least 80% of customer crypto to be held in cold storage, and the five won-market exchanges currently hold more than 95% in cold wallets, according to the regulator.

What a No-Action Letter Actually Is

The phrase sounds technical, and it is worth understanding precisely, because the whole story turns on it.

A no-action letter is a written statement from a regulator saying that, on the facts described, it will not take enforcement action against a particular practice. It is not a new law, and it is not a licence. It is a promise of forbearance: the regulator is telling the industry that a specific course of action will not be punished, even though the existing rules might appear to forbid it.

That matters here because South Korea's Virtual Asset User Protection Act, as currently understood, leaves exchanges in a bind. The law says an exchange may not block a customer's deposits or withdrawals without a justifiable reason. In practice, that has been interpreted to mean a block is allowed only once a hacking incident has been clearly established — in other words, once the exchange can prove it has been breached.

The problem is timing. Proving a breach takes hours or days: logs must be examined, wallets traced, and the difference between a glitch, an insider error and an attack established. Stealing crypto takes minutes. By the time an exchange can prove it has been hacked, the stolen funds have usually already moved through mixers, bridges and swaps, and are far harder to recover. The FSC's no-action letter is designed to close that gap: an exchange that sees signs of an attack — abnormal trading activity, unusual withdrawals, a suspicious pattern in its hot wallets — can freeze deposits and withdrawals first and establish the facts afterwards, without fearing a regulatory penalty for the freeze itself.

The letter has not been issued yet, and the conditions attached to it have not been published. That is an important caveat. The FSC has announced the decision and the direction of travel, but the precise circumstances in which a preventive freeze is allowed, how long it may last, and what an exchange must do to justify it afterwards are still to be defined. Until the letter is published, exchanges do not have the protection in hand — they have a regulator's stated intention to give it to them.

The Incidents That Forced the Decision

The FSC's announcement did not come out of nowhere. It followed a concentrated run of security incidents in South Korea's crypto market, and the regulator's own inspection findings.

Gopax, 6 November. Gopax, operated by Streami, suspended deposits and withdrawals and halted trading after receiving an email threatening a hack. No intrusion or theft was detected, and the exchange moved all of its holdings to cold wallets. Trading was halted at 15:53 Korean time, deposits and withdrawals at 14:55. There was no resumption date at the time of reporting. Gopax's operator was among the exchanges at the FSC's meeting on 12 November.

Prabang, 24 October. Prabang detected abnormal hot-wallet withdrawals, suspended services and reported losses of about 100 million won, roughly $70,000. Unlike Gopax, this was a confirmed theft, not a threat.

Bithumb. The FSC's wider review also covered a breach at Bithumb's Daou Office, affecting 715 employees and 844 customers, reported in the same period.

The regulator's own findings. In October, the FSC reviewed 555 financial companies and found cybersecurity deficiencies at 130 of them. Research cited in the coverage counts more than 37 South Korean financial firms hit by cyber incidents between late September and early November 2026, with around 473,000 records exposed and roughly 1 billion won stolen. The FSC held an emergency meeting on 2 November, and its Financial Supervisory Service has a meeting of chief information security officers scheduled for 19 November.

The Binance precedent. The FSC cited the late-October Binance theft — about $6.3 billion, the largest exchange hack on record — as the case showing that rapid blocking is decisive. In that incident, billions were moved and laundered within days, and the speed of the response determined how much could be frozen. The FBI has formally attributed the theft to North Korea.

The pattern across all of these is the same: the decisive window is measured in minutes, and the rules as written did not let exchanges act inside it. The no-action letter is the regulator's answer to that mismatch.

What Changes for Korean Exchanges — and What Does Not

The FSC's package has two halves, and the second half matters as much as the first.

The relief. Exchanges will be able to suspend deposits and withdrawals when hacking is suspected, without waiting for confirmation that customer assets have been stolen. The trigger moves from proof to suspicion — specifically, signs such as abnormal trading activity or suspicious withdrawal patterns. The regulator has said the relief will be conditional, but has not yet published the conditions.

The conditions and the tougher expectations. The FSC paired the relief with stronger security requirements. Exchanges are to maintain security monitoring and incident-response systems around the clock. Those that cannot provide 24-hour monitoring must restrict deposits and withdrawals to the periods they are actively monitored, and must disclose those schedules publicly in advance. The regulator also called for higher cold-wallet holdings, stronger insurance coverage and stronger reserves, and it plans to expand security inspections through the Financial Security Institute — only five of South Korea's 28 registered virtual asset businesses are currently members of the institute, which will update its exchange-specific inspection standards by the end of 2026. The authorities also plan to include information-technology safety and damage-compensation obligations in a draft Digital Asset Act.

What does not change. The 80% cold-storage minimum remains in place, and the five won-market exchanges already exceed it, holding more than 95% of assets in cold wallets. The no-action letter does not give exchanges a free hand to freeze funds at will: the freezes are to be permitted under specified conditions, and the regulator has not yet said what those are. And the letter itself has not been issued — the FSC has decided to issue it, which is a step short of having done so.

The balance the regulator is striking is deliberate. A preventive freeze protects users when an attack is real, but it also locks out innocent users when the alarm turns out to be false. Gopax's 6 November halt is the example: the exchange froze everything on the basis of a threat email, and no intrusion was found. Users were locked out of their funds for a threat that did not materialise. The conditions the FSC attaches to the letter — and how strictly it enforces them — will decide whether preventive freezes become a routine safety tool or a source of new disputes.

The India Angle: Unocoin, and the Rule India Does Not Have

The FSC's decision lands in India at an awkward moment. On 12 November, Unocoin — one of India's oldest crypto exchanges, operating since 2013 — published a security update confirming that its infrastructure had been compromised, that it had detected outgoing transactions from an Ethereum wallet held with its custody provider BitGo, and that it is rebuilding its server systems from scratch. User logins have been disabled since 9 November, and the exchange estimates four to five working days for the rebuild, plus security validation. No loss figure has been confirmed.

The parallel is direct. Unocoin detected suspicious activity on 6 November and asked its custody providers, BitGo and Fireblocks, to freeze its enterprise accounts. That is the same kind of preventive action the FSC is now formalising in South Korea — freezing first, establishing the facts afterwards. The difference is the legal footing. In South Korea, the FSC is now giving exchanges a regulator's written assurance that a preventive freeze will not be punished. In India, there is no equivalent rule and no equivalent assurance.

What governs an Indian exchange's ability to suspend withdrawals today is a patchwork. An exchange's own terms of service typically reserve the right to suspend services for security reasons. Its registration with the Financial Intelligence Unit (FIU-IND) is an anti-money-laundering registration, not a security guarantee or a solvency backstop. The Prevention of Money Laundering Act and the Information Technology Act give authorities powers to investigate and to direct action, but they do not set out a clear, published framework for when an exchange may freeze user funds on suspicion of a hack, how long it may do so, or what it owes users afterwards. There is no Indian equivalent of a no-action letter for preventive freezes, and no published Indian standard for the conditions that should apply.

That gap matters for Indian users in two ways. First, when an Indian exchange suspends services — as Unocoin has — users have limited recourse: no deposit insurance, no regulator hotline that restores access, and no published service-level guarantee. Second, when an exchange hesitates to freeze because it fears the legal consequences of locking users out, the delay can cost users their funds. The South Korean decision is an attempt to remove the hesitation on the second point while managing the risk on the first, by attaching conditions to the permission.

None of this means India should or will copy South Korea's approach. The two markets differ in structure, in the role of the regulator, and in the legal framework. But the question the FSC answered — how fast may an exchange act on suspicion, and who bears the cost if it is wrong — is the same question Indian users are asking this week, and it is one Indian regulators have not yet answered in public.

What Indian Users Should Take From This

The FSC's decision is a foreign regulatory story, and it does not change any Indian rule. But it is useful in three practical ways for Indian users.

First, understand what a freeze means. When an exchange suspends withdrawals, it is not necessarily evidence that funds have been stolen. Gopax froze everything on a threat and found no intrusion. Unocoin froze logins on suspicious activity and later confirmed a compromise, but has not confirmed a loss figure. A freeze is a precaution, and the reason for it matters more than the freeze itself. Read the exchange's own statements — its blog and its official social-media accounts — and treat any other source promising a reopening time as unverified.

Second, keep your own records. Screenshots of your holdings, deposit history and any emails from the exchange are your own account of what you held. If an exchange goes offline for days, as Unocoin has, your own records are the only evidence you control. Never share your seed phrase, private keys or one-time passwords with anyone, including anyone claiming to be exchange support — scammers exploit exchange outages with fake recovery offers.

Third, know the limits of the protections you have. FIU-IND registration is an anti-money-laundering registration. It does not guarantee that an exchange's systems are secure, that your funds are safe, or that you will be able to withdraw them at any moment. Cold storage — the practice of keeping most customer crypto offline — is a real protection, and Korean exchanges hold more than 95% of assets in cold wallets against an 80% legal minimum. But cold storage protects against theft, not against an exchange suspending access while it rebuilds its systems. The tax rules are unchanged: crypto gains are taxed at 30% plus a 4% cess, with 1% TDS on transfers, and the 30% rate and 1% TDS described here were current as of September 2026.

What to Watch Next

Three things will show whether the FSC's decision becomes a working rule or stays an announcement.

• The letter itself. The FSC has decided to issue the no-action letter but has not published it, given an issue date, or spelled out the conditions. The text of the letter — what counts as suspicion, how long a freeze may last, and what an exchange must do afterwards — is the real test.
• The 19 November meeting. The Financial Supervisory Service has a meeting of chief information security officers scheduled for 19 November, and the Financial Security Institute is to update its exchange-specific inspection standards by the end of 2026. Both will show how the tougher security expectations are being enforced.
• Whether other regulators follow. South Korea is the first major market to formalise preventive freezes in this way. Whether regulators elsewhere — including India — address the same question, and how they answer it, will shape how exchanges handle the next incident. For now, the Indian position remains what it was: exchanges act under their own terms and their anti-money-laundering obligations, with no published framework for preventive freezes.

None of these is a signal to act on by itself. They are the facts to watch while the letter is still unpublished, and they are the facts that will determine whether this decision is remembered as a genuine change in how exchanges may respond to attacks, or as a press release that changed little.

The Bottom Line

On 12 November 2026, South Korea's Financial Services Commission decided to issue a no-action letter letting crypto exchanges block deposits and withdrawals when a hack is merely suspected, instead of only once a breach has clearly occurred. The decision follows the Gopax halt on 6 November, the Prabang theft on 24 October, the regulator's finding of cybersecurity deficiencies at 130 of 555 financial companies, and the $6.3 billion Binance theft that the FSC cited as proof that speed matters. The letter has not been issued yet, its conditions have not been published, and it comes paired with tougher requirements for 24-hour monitoring, cold storage and insurance. For Indian users, the decision changes nothing directly — India has no equivalent rule — but it answers a question that is live in India this week, after Unocoin suspended all services following a security breach: how fast may an exchange freeze your money on suspicion, and who bears the cost if it is wrong. The tax rules — 30% plus a 4% cess, with 1% TDS — are unchanged.

Keep Learning

• Gopax Halt and South Korea's Exchange-Security Crackdown: What Indian Users Should Know — the 6 November Gopax halt and the Korean crackdown that led to this decision, including the 80% cold-storage rule.
• Unocoin Security Breach: Services Suspended in India — the Indian exchange breach this week, and what Indian users should do while the exchange is offline.
• ED Searches CoinDCX and Delta Exchange Over Offshore Trades: FEMA Explained — the other big Indian-exchange story of the month, and what the FEMA investigation means for users.