South Korea has stepped up scrutiny of its cryptocurrency industry as security threats continue to target digital asset platforms.
The latest Binance breach has renewed concerns about North Korean hacking groups and weaknesses in exchange security systems.
Regulators are now examining whether domestic platforms can withstand similar attacks. Meanwhile, the growing use of artificial intelligence in cyber operations has added pressure on financial institutions to strengthen their defenses.
South Korea FSC summons crypto exchanges after $6.4 billion Binance hack
South Korea’s Financial Services Commission (FSC) summoned major cryptocurrency exchanges on Monday to review their security measures. The meeting followed a reported $6.4 billion Binance breach that raised concerns about exchange vulnerabilities.
The FSC invited working-level representatives from five won-based exchanges, including Upbit, Bithumb, Coinone, DigitalX and Gopax. Representatives from coin-market platforms, including Foblgate, also attended the meeting at 10 a.m. Each company sent one or two employees.
An FSC official said regulators wanted to assess domestic exchanges’ preparedness following the Binance incident. The meeting also preceded a broader security inspection covering the financial sector on Wednesday.
South Korea’s Virtual Asset User Protection Act requires exchanges to store at least 80% of customer deposits in cold wallets. Upbit reportedly holds more than 99% of customer assets offline. Bithumb maintains approximately 94%, while Coinone holds roughly 85%.
DigitalX and Streami, which operates Gopax, maintain cold-wallet reserves in the low 80% range. Regulators are considering whether exchanges should increase these requirements.
The measures target vulnerabilities associated with hot wallets, which remain connected to the internet. Attackers reportedly stole Binance funds from these online wallets during the October 29 incident.
FBI links Binance hack to North Korea as AI cyberattacks expand
The Binance breach exposed the growing threat from North Korean hacking groups targeting cryptocurrency platforms. TRM Labs traced approximately $6.36 billion in stolen funds across ten blockchain networks. Most transactions occurred within approximately 20 minutes.
On October 31, the FBI attributed the attack to North Korea’s TraderTraitor group. The agency also linked the group to last year’s $1.5 billion Bybit hack.
The FBI urged cryptocurrency exchanges and blockchain analytics firms to block addresses associated with the stolen funds. Investigators said the attackers were converting the stolen assets into Ether.
However, President Donald Trump questioned the attribution during a Halloween event in Florida. He said authorities did not know whether North Korea carried out the attack.
Binance said it had sufficient reserves of the affected assets to cover 90% of the missing funds. The exchange also pledged to reimburse affected customers.
Meanwhile, South Korean authorities are investigating separate security breaches involving Bithumb, Daishin Securities and Mirae Asset Global Investments. Police are examining possible connections to an earlier attack wave affecting 16 companies.
Investigators reportedly identified ARTEX, a Chinese-built open-source penetration-testing tool, in the earlier incidents. The tool operates alongside AI models such as Claude Code.
Daishin Securities exposed information belonging to 38,490 customers. Across the 16 affected companies, approximately 100,000 records faced exposure by October 14.
The FSC had already inspected 555 financial companies and identified 130 with security weaknesses. These included missing software patches and inadequate real-time monitoring.
At Bithumb, attackers accessed Daouoffice mobile groupware and exposed sensitive information belonging to 844 customers. The compromised records included resident registration numbers, account details and identification copies.
Prabank suffered financial losses of approximately 100 million won and suspended services. Microsoft Threat Intelligence also identified three North Korean groups, Jade Sleet, Coral Sleet and Jasper Sleet, as incorporating AI throughout their operations. The company identified cryptocurrency exchanges and financial institutions as major targets. However, no evidence currently links AI tools to the Binance hack.
South Korea’s crypto compensation rules remain delayed
South Korea’s latest emergency meeting follows earlier regulatory efforts to strengthen exchange accountability. In February, FSC Chairman Lee Eog-weon convened officials from the Korea Financial Intelligence Unit and Financial Supervisory Service.
The meeting followed Bithumb’s accidental distribution of Bitcoin to customers. Lee called for stronger internal controls and strict liability requirements for customer losses.
However, the proposed compensation framework still lacks legal backing. South Korea’s Digital Asset Basic Act, which covers issuance, disclosure and customer compensation, remains unpassed.
During an October 22 parliamentary audit, lawmakers from both parties questioned the legislative delay. Democratic Party representative Min Byungdeok highlighted regulatory progress elsewhere.
He noted that the United States passed its GENIUS Act in July 2025, followed by Hong Kong in August 2025. Min criticized South Korea for failing to advance comparable legislation.
Lee responded that consultations over the Digital Asset Basic Act had reached their final stages.
Regulators have proposed requiring exchanges to compensate customers for hacking incidents and system failures within their control. The provision would introduce no-fault liability for affected users.
Until lawmakers pass the legislation, South Korean cryptocurrency customers face limited compensation protections following exchange security breaches.
