South Korea regulator urges exchanges to lift cold wallet share after Binance hack

South Korea's Financial Services Commission has urged domestic crypto exchanges to increase the share of assets they hold in offline wallets after the $6.3 billion attack on Binance last week. In a statement Monday, the regulator said it held an emergency meeting with the Financial Supervisory Service, the Financial Security Institute, the Digital Asset eXchange Alliance (DAXA) and major crypto service providers to review the impact of the Binance hack on South Korea's market and to review exchanges' security measures, Cointelegraph reported.

The Nov. 2 meeting was chaired by Yoo Youngjun, director general for digital finance policy, according to The Asia Business Daily. The agencies on hand were the Financial Supervisory Service, the Financial Security Institute, DAXA and the major virtual asset service providers themselves. The meeting covered the attack's impact on the domestic virtual asset market and the response systems the providers already have in place. The regulators reviewed access controls on providers' IT systems, approval and signing procedures for withdrawals from hot wallets, and the management of administrator privileges. They then ordered providers to raise the share of assets held in cold wallets, the wallets that are not connected to the internet.

A statutory floor already applies. Under the Act on the Protection of Virtual Asset Users, providers must keep at least 80% of customer assets in cold wallets, though the ratio varies by provider. Cold wallet holdings differ considerably among the country's major exchanges. At the end of September, Upbit's cold wallet ratio stood at 99.17%, followed by Bithumb at 94.76% and Coinone at 85%, according to Financial Supervisory Service data cited by local media. Digital X, formerly Korbit, reported 82.79% and GOPAX 80.54%, the report said. Every one of those figures sits above the legal minimum, which leaves the regulator asking for more than the statute already demands.

The wallets the regulator is pushing are not connected to the internet, which is the property the FSC's order targets. The assets Binance lost sat in internet-connected hot wallets, the category exchanges use to process customer withdrawals and the one the Korean rules already hold to a minority share of user balances.

The meeting followed Binance's Oct. 29 disclosure that virtual assets worth roughly $6.3 billion, about 8 trillion won, had been withdrawn without authorization. Possible causes cited at the time include access to internal systems through employees' work laptops and withdrawals enabled by unauthorized access to transaction approval and signing systems, The Asia Business Daily reported. Blockchain intelligence firm TRM Labs estimates that attackers took about $6.3 billion from Binance's internet-connected hot wallets and moved most of that in roughly 20 minutes, and Binance has said the vast majority of user assets are held in cold storage, according to Cointelegraph.

Beyond the cold wallet share, the FSC asked providers to monitor deposits and withdrawals continuously, secure additional incident response personnel, and report and share information about unusual access attempts promptly. Operators were also asked to set aside additional reserves and to adopt other security measures that could be introduced immediately to prevent similar breaches.

The commission framed the outreach as open-ended. "We plan to continue strengthening our response systems in close cooperation with relevant agencies and the industry to prevent further security incidents such as hacking and limit the spread of damage," the FSC said, in a passage rendered in English by The Asia Business Daily. Cointelegraph said it reached out to Upbit, Bithumb, Coinone, Digital X and GOPAX for comment.

The central bank is running a parallel review. The Bank of Korea is surveying 18 banks and 13 brokerages about their exposure to crypto-related risks, including major exchange hacks and prolonged market downturns, and that review began before the Binance attack.