South Korea wants an emergency brake for crypto withdrawals. Who protects customers after it is pulled?

South Korea's Financial Services Commission (FSC) convened exchanges, custodians and security bodies on 12 November to discuss crypto-asset security. It decided to issue a no-action letter intended to give operators room, under conditions yet to be specified, to pause deposits and withdrawals when an intrusion is suspected. It also plans emergency security guidance. This is neither a blanket freeze on Korean exchanges nor an enacted Digital Asset Act. The question has moved upstream: who may stop an abnormal transfer before assets leave, and who must explain the stop to customers?

Three defenses at different stages

First is staffing. The FSC called for monitoring and response suited to a round-the-clock market. Operators unable to monitor continuously should process deposits and withdrawals only while their monitoring works, tell users in advance and staff those hours adequately. That is not a promise of 24-hour withdrawal access.

Second is custody and capacity to make customers whole. Existing Korean rules require at least 80% of customer crypto assets in cold wallets; the FSC says the sector's aggregate ratio exceeds 95%. It nevertheless urged operators to keep hot-wallet customer assets at the minimum needed for trading, consider dispersing hot wallets and increase insurance limits and reserves. A high sector-wide cold-storage ratio does not prove that any one exchange can cover a particular loss, or that every withdrawal instruction is authorized. If the vulnerable portion is stolen, who funds the shortfall and how quickly?

Third is authority to stop a transfer. Korea's Virtual Asset User Protection Act generally bars blocking deposits or withdrawals without proper grounds. The FSC said the position before a hack is confirmed was unclear, so it decided to issue a no-action letter for precautionary blocks where an intrusion is suspected. The letter's exact conditions and operative text still need to be seen. It is not an unlimited, already-effective power to freeze customers.

A brake needs a dashboard

A pause can interrupt an attack, but it can also hold legitimate customers' money. In TraderVote's view, operators should disclose the trigger, affected assets and accounts, approver, review time, user notice, restoration path and means to contest a mistaken block. Without a time limit and auditable record, customers cannot tell risk containment from a liquidity problem.

The FSC also said only five won-market exchanges among 28 Korean virtual-asset businesses have joined the Financial Security Institute. It will encourage wider membership and aims to update exchange-specific checks covering wallets, blockchains and smart contracts this year. A proposed Digital Asset Act would bring bank-like IT-safety and damages duties; that proposal is not law today.

Cold storage reduces what is exposed; a timely pause limits how far a loss spreads; insurance and reserves determine whether compensation promises can be honored. These safeguards solve different problems. Korea's measures address businesses under its jurisdiction, not every cross-border account held through an offshore contracting entity. Customers must still identify their legal counterparty, custodian, applicable supervisor and route to redress.

Sources: FSC, “Top-Level Security Measures for Virtual Asset Service Providers,” 12 November 2026; FSC, “New Enforcement Decree on the Protection of Virtual Asset Users Approved by the Government,” 25 June 2024; BizWatch, report on the 12 November 2026 FSC meeting. Accessed 12 November 2026, Los Angeles time. Cover is a conceptual illustration, not an exchange facility or incident photograph.

This article is not investment advice.