South Korea demands stronger crypto safeguards following Binance hack

South Korea’s Financial Services Commission has directed domestic cryptocurrency exchanges to hold more assets in cold wallets and strengthen their financial reserves following the $6.3 billion Binance hack on October 29.

Summary

• South Korea’s Financial Services Commission has urged domestic crypto exchanges to raise cold wallet holdings and strengthen financial reserves following Binance’s $6.3 billion hack.
• The regulator held an emergency meeting with major exchanges and financial authorities to review withdrawal approval systems, administrator access controls and transaction monitoring procedures.
• Domestic exchanges are already required to keep at least 80% of customer crypto assets in cold storage, although the regulator has not announced a new minimum threshold.
• Binance said it had replenished approximately 95% of the stolen assets by November 1 and subsequently restored withdrawals for 51 additional tokens on November 3.

According to a November 2 report by ChosunBiz, the regulator convened an emergency meeting with major virtual asset service providers to review their security arrangements and assess whether the incident had affected South Korea’s cryptocurrency market.

The meeting was chaired by Yu Young-jun, the FSC’s director of digital finance policy, and included representatives from the Financial Supervisory Service, the Financial Security Institute and the Digital Asset eXchange Alliance (DAXA).

Officials examined how domestic exchanges manage access to their internal systems, approve cryptocurrency withdrawals and control administrator privileges. Exchanges were subsequently asked to strengthen their security procedures, maintain additional reserves and prepare for suspicious transactions or unauthorized access attempts.

South Korea pushes exchanges to hold more crypto in cold wallets

Under South Korea’s Virtual Asset User Protection Act, cryptocurrency service providers must already hold at least 80% of customers’ deposited digital assets in cold wallets, which remain disconnected from the internet.

The FSC has now asked exchanges to raise their cold storage ratios beyond their existing levels, although the regulator did not announce a new uniform minimum during the meeting.

The current ratios differ considerably between exchanges, according to Financial Supervisory Service data submitted to Democratic Party lawmaker Min Byeong-deok and reported by The Herald Business.

As of the end of September, Upbit held 99.17% of customer assets in cold storage, followed by Bithumb at 94.76% and Coinone at 85%. DigitalEx and GOPAX reported ratios of 82.79% and 80.54%, respectively.

The regulator’s instructions extended beyond wallet storage. Exchanges were asked to maintain continuous monitoring of deposits and withdrawals, assign additional personnel to incident response and establish procedures for promptly sharing information about abnormal access attempts.

Through DAXA, authorities requested reports on exchange-level deposit and withdrawal activity associated with the Binance incident.

Binance hack prompts scrutiny of withdrawal approval systems

The October 29 attack resulted in approximately $6.3 billion in unauthorized cryptocurrency withdrawals from Binance’s hot wallets, making it the largest single cryptocurrency theft reported to date.

Unlike offline storage, hot wallets remain connected to the internet so exchanges can process customer transactions and withdrawals.

Investigators have examined whether attackers gained access to Binance’s internal systems through an employee’s compromised work laptop and subsequently interfered with the mechanisms used to authorize transactions.

As previously covered by crypto.news, the attack involved transactions across multiple blockchain networks, while blockchain security firms traced the movement of stolen assets and identified attempts to transfer funds out of affected wallets.

Exchanges face additional reserve requirements

Beyond cryptocurrency custody, authorities urged exchanges to build up financial reserves that could be used to respond to security incidents.

South Korea’s existing user protection framework requires virtual asset service providers to maintain financial safeguards through insurance, mutual aid arrangements or dedicated reserves.

For exchanges handling Korean won transactions, the reserve requirement can be at least 3 billion won, depending on the applicable arrangements.

The FSC did not specify how much additional money individual exchanges would need to set aside.

Binance continues replacing stolen assets and restoring withdrawals

Meanwhile, Binance has continued replenishing the cryptocurrencies stolen during the breach while gradually restoring access to withdrawals.

The exchange completed reserve verification for ten major cryptocurrencies on November 2, allowing customers to check whether their holdings were backed by sufficient assets.

Binance said it had replaced approximately 95% of the affected cryptocurrencies by November 1, using its Secure Asset Fund for Users, Futures Insurance Fund and corporate treasury resources.

The remaining assets consisted primarily of less liquid tokens that required additional time to acquire.

On November 3, Binance restored withdrawals for 51 additional tokens across Ethereum and Solana, including LINK, SHIB, ONDO and BONK.

Binance has scheduled another Proof of Reserves snapshot for November 4, covering more cryptocurrencies than the ten assets included in its previous verification.