Crypto exchanges to be allowed to block deposits and withdrawals even when hacking is suspected

[Financial News] Financial authorities will issue a no-action opinion allowing virtual asset service providers to proactively suspend deposits and withdrawals under certain conditions even when a hacking incident is suspected. They will also require security measures on par with those of financial institutions, including 24-hour monitoring and expanded cold-wallet storage.
On the 12th, the Financial Services Commission (FSC) held a meeting on security measures for the virtual asset industry, chaired by Vice Chairman Shin Jin-chang, to review the status of cybersecurity incidents involving virtual asset service providers and response measures. Attendees included the Financial Supervisory Service, the Financial Security Institute, the Digital Asset eXchange Alliance (DAXA), virtual asset exchanges and custody providers.
The current Act on the Protection of Virtual Asset Users prohibits service providers from blocking deposits and withdrawals without just cause, and permits such blocks only when a hacking incident has clearly occurred. This prompted concerns that it was unclear whether providers could proactively block deposits and withdrawals when a hack was only suspected, such as in cases involving abnormal transactions.
The FSC considers swift blocking measures important to prevent the damage from spreading in virtual asset security incidents. It has therefore decided to issue a no-action opinion allowing providers to block deposits and withdrawals under certain conditions when a hack or security breach is suspected. A no-action opinion is a measure through which financial authorities state in advance that they will not impose sanctions if specific conduct meets certain conditions.
The FSC will also draw up Emergency Response Guidelines for Security Incidents at Virtual Asset Service Providers, which can be applied immediately, even before the law is enacted. Given that virtual asset trading takes place around the clock, providers will be required to keep designated staff on duty at all times and immediately implement necessary control measures when signs of a possible incident, such as abnormal large-scale transactions, are detected.
Providers that have difficulty operating continuous monitoring and response systems must process deposits and withdrawals only during hours when those systems are functioning normally. In such cases, they must inform users of their operating hours in advance and assign enough staff to handle deposit and withdrawal requests.
The FSC plans to increase the proportion of user assets held in cold wallets as much as possible. Under current regulations on the supervision of the virtual asset industry, the required cold-wallet storage ratio is 80%, but the actual ratio across all providers is at least 95%. The FSC also called on providers to keep the amount of users’ virtual assets held in hot wallets to the minimum needed to support trading and consider distributing them across multiple hot wallets. It plans to ensure that providers have sufficient insurance coverage limits and reserve funds to facilitate compensation in the event of hacking losses.
Through the Digital Asset Act, which is currently being prepared, the FSC plans to require virtual asset service providers to meet information technology (IT) security obligations on par with those of financial institutions and to assume liability for damages. Even before the law is enacted, providers will be required under the guidelines to analyze and assess vulnerabilities in their information-processing systems and communications networks and take remedial measures. A system will also be established for promptly reporting security incidents and abnormal attempts at external access to financial authorities.
The FSC will also expand membership in the Financial Security Institute among virtual asset service providers. Of the 28 providers currently operating, only five—the won-market exchanges—are members. The FSC will promote additional memberships in light of factors such as providers’ user bases, and plans to support members with information-sharing on security threats, security vulnerability assessments and professional training. Providers that have difficulty joining will receive support to identify vulnerabilities and establish alert systems at a level comparable to that of small and medium-sized financial institutions.
The Financial Security Institute will conduct security inspections of its member institutions that are virtual asset service providers. For providers that are difficult to inspect directly, it will offer Security Inspection Standards Tailored to Virtual Asset Exchanges for use in self-inspections or inspections conducted by specialized information security firms. The existing inspection standards are also set to be revised within the year to incorporate stronger transaction verification and wallet access controls, among other measures.
Vice Chairman Shin noted that information leaks and security incidents have occurred one after another in the virtual asset industry recently, but that some providers’ security awareness has yet to move beyond the pre-institutionalization stage. He went on to emphasize that virtual asset service providers, too, must establish security systems on par with those of traditional financial institutions, since they hold and manage users’ assets.

[email protected] Lee Jeong-hwa Reporter