FSC conducts emergency review of exchange security after Binance breach
Regulators urge higher cold-wallet ratios, reserve top-ups and round-the-clock monitoring
Staffing costs and operational gaps complicate uniform standards
No-fault liability rules remain absent from law, leaving user protection incomplete
South Korea's financial authorities have been pressing domestic virtual asset exchanges to strengthen security measures following the 8 trillion won ($5.97 billion) hack at Binance, but industry players say operational and staffing constraints make swift compliance difficult — suggesting any meaningful overhaul is still some time away.
According to industry sources, the Financial Services Commission convened an emergency meeting Monday, chaired by Yu Yeong-jun, director general of digital finance policy, with officials from the Financial Supervisory Service, the Korea Financial Security Institute, the Digital Asset Exchange Alliance (DAXA) and major virtual asset service providers to assess the industry impact of the Binance hack and review existing response frameworks.
At the meeting, the FSC checked each operator's cold-wallet storage ratio, insurance coverage and reserve accumulation. Regulators also focused on security systems designed to prevent incidents similar to the Binance breach, including access controls for computer systems, withdrawal approval and signing procedures for digital wallets, and administrator privilege management.
Authorities particularly urged exchanges to take immediate steps: raising the proportion of assets held in cold wallets, establishing round-the-clock deposit and withdrawal monitoring, securing additional response personnel and building up reserves.
An FSC official described the meeting as "an opportunity to check the security response status of each exchange," adding that "additional meetings can be held if necessary regarding security." On user protection measures in the wake of the hack, the official said the relevant provisions "will be incorporated into legislation."
With the enactment of a basic digital assets law running behind schedule, however, observers expect regulators to first pursue supplementary guidelines or separate directives to shore up security standards. The most frequently discussed measure is raising the mandatory cold-wallet storage ratio.
Cold wallets store digital assets in an environment isolated from the internet, making them less vulnerable to hacking than hot wallets connected online. A key advantage is that withdrawals require a person to manually verify and sign each transaction, allowing abnormal outflows to be caught before they go through. Under the current Virtual Asset User Protection Act, operators must keep at least 80 percent of the economic value of users' digital assets in cold wallets.
Cold-wallet ratios currently vary across exchanges. Data submitted to Democratic Party of Korea lawmaker Min Byeong-deok by the Financial Supervisory Service showed that as of end-September, Upbit held 99.17 percent of assets in cold wallets, Bithumb 94.76 percent, Coinone 85 percent, DigitalEx 82.79 percent and Gopax 80.54 percent. All met the legal minimum, but the gap between the highest and lowest ratios reached 18.63 percentage points.
![[Yonhap]](https://wimg.heraldcorp.com/news/cms/2026/11/03/news-p.v1.20261103.ba119e58f20c478e8c882c669c39059c_P1.png)
Within the industry, voices are emerging that uniformly raising cold-wallet ratios would create real operational difficulties. Because each exchange differs in its asset holdings, trading volume and liquidity management approach, applying a single standard could significantly increase the burden on operators.
Round-the-clock security monitoring and enhanced deposit and withdrawal surveillance are also flagged as areas requiring further discussion. Authorities have called on exchanges to maintain continuous monitoring systems and hire additional staff to detect and respond quickly to abnormal access attempts and transaction activity. But the industry says a uniform standard is hard to apply given that exchanges differ in their security personnel, monitoring setups and use of outside specialists.
Upbit, which suffered a hack last year, was found to have a double-digit dedicated information security workforce. One virtual asset industry official said that "running cold-wallet operations around the clock requires at least 15 staff, and setting up a three-shift system means securing around 20 people," adding that "smaller exchanges have different scales and profit margins, making it difficult for them to build the same level of systems."
Another industry official said that "signing duties are high-stakes, so handling them alongside other responsibilities risks cutting corners in the verification process — they need to be kept separate." The official added that expanding the dedicated signing workforce "will drive up operating costs."
Some observers say the more fundamental priority is regulatory reform. Article 9 of the current Electronic Financial Transactions Act requires financial companies and electronic financial service providers to bear liability in principle when users suffer losses from certain electronic financial incidents. Digital asset exchanges fall outside the scope of that law, however, and calls have grown for separate legislation to raise the level of user protection.
Some are calling for the second phase of legislation to more clearly define exchange liability. Neither the current Act on Reporting and Using Specified Financial Transaction Information nor the Virtual Asset User Protection Act contains explicit provisions on no-fault liability for exchanges. Incorporating such provisions into a basic digital assets law would naturally strengthen exchange accountability for user losses stemming from hacks or withdrawal delays.
Meanwhile, a surge in hacking incidents across the virtual asset industry has led to a sharp increase in emergency security review requests from financial authorities. Following a personal data leak at Bithumb, some exchanges received requests to check whether their internal groupware and shared email systems had been targeted. After the Binance hack, the scope of checks expanded to include internal system access controls, administrator privilege management and 24-hour monitoring. One industry official said that "before, most inquiries were routine checks on customer numbers or deposit and withdrawal volumes, but recently the volume of security-related data requests has felt like it has increased more than tenfold."
kyoung@heraldcorp.com
