FSC holds virtual asset security meeting
Emergency security guidelines to be established
Cold wallet storage of user assets to be maximized
Round-the-clock monitoring and response systems required
Domestic virtual asset exchanges will be allowed to immediately freeze deposits and withdrawals even when a hacking attack is only suspected, under new measures announced Thursday. The government also plans to impose bank-level liability for damages on virtual asset exchanges through a forthcoming digital asset law.
The Financial Services Commission held a virtual asset industry security meeting Thursday, chaired by Vice Chairman Shin Jin-chang. The meeting came in response to a string of cybersecurity incidents, including a hacking attack on Binance, the world's largest virtual asset exchange.
To minimize hacking damage, the FSC said it will issue a "no-action letter" allowing exchanges to proactively freeze deposits and withdrawals when a suspected security breach occurs — even before a hack is confirmed. Under the current Virtual Asset User Protection Act, operators may only impose such freezes once a hacking incident has been clearly established.
Alongside this, the FSC will establish emergency response guidelines for security incidents at virtual asset operators.
Under the draft guidelines, virtual asset operators must maintain round-the-clock monitoring and response systems to reflect the around-the-clock nature of crypto trading. Dedicated personnel must be on duty at all times and must take immediate control measures when suspicious activity — such as abnormally large transactions — is detected.
Operators will also be required to maximize the proportion of user assets held in cold wallets and to expand insurance coverage limits and reserve funds. Currently, the industry-wide cold wallet storage ratio stands at 95 percent or above, already exceeding the 80 percent threshold set under supervisory regulations.
"There is a need to keep the amount of user-entrusted virtual assets held in hot wallets to the minimum necessary for transaction support, and to consider distributing holdings across multiple hot wallets," an FSC official said.
The FSC also plans to use the digital asset law, set to be announced soon, to impose on digital asset operators the same safety standards and liability for damages required of financial companies. Even before the law takes effect, operators will be required to meet security obligations equivalent to those applied to companies covered by the Electronic Financial Transactions Act.
In addition, the FSC plans to provide exchange-specific security audit standards so that operators unable to undergo direct inspections through the Korea Financial Security Institute can conduct their own reviews or hire specialized information security firms. Smaller operators will receive security support equivalent to that provided to small and midsize financial companies.
"Some operators' awareness of security remains stuck in a pre-regulatory era, out of step with the growth of the virtual asset market and the expectations placed on the industry," Vice Chairman Shin said. "Because virtual asset operators hold and manage assets entrusted to them by users, they need the same level of security framework as traditional financial companies."
Meanwhile, the FSC announced a financial sector security system overhaul plan on Nov. 5 and has committed to completing a comprehensive security review of the entire financial industry by year-end.
hyuk@heraldcorp.com
