In response to a series of hacking incidents and data breaches, financial authorities are significantly tightening security regulations for cryptocurrency exchanges. Exchanges will be allowed to proactively block deposits and withdrawals even when hacking is suspected. Additionally, a 24-hour monitoring system will be established, and the use of cold wallets (offline wallets) for user assets will be expanded. The upcoming Digital Asset Law is expected to impose security obligations and liability for damages equivalent to those of financial institutions.
On November 12, the Financial Services Commission (FSC) held a 'Security Measures Meeting for the Cryptocurrency Industry' chaired by Vice Chairman Shin Jin-chang to discuss the response systems for security breaches and measures to enhance security for cryptocurrency businesses.
This decision comes amid a growing urgency to strengthen security systems to protect user assets following repeated hacking and data breach incidents at domestic and international cryptocurrency exchanges.
Initially, the FSC decided to issue a no-action letter allowing exchanges to block deposits and withdrawals proactively in situations where hacking is suspected.
Currently, the Cryptocurrency User Protection Act prohibits blocking deposits and withdrawals without just cause. While blocking is allowed when a hacking incident is evident, the criteria for blocking during suspicious transactions were unclear. Moving forward, the no-action letter will enable businesses to swiftly block deposits and withdrawals in situations where hacking or security breaches are suspected.
The monitoring system for exchanges will also be strengthened. Considering that the cryptocurrency market operates year-round, monitoring personnel will be deployed 24/7, and immediate control measures will be implemented if abnormal large transactions are detected. Businesses unable to maintain a constant response system will only be allowed to process deposits and withdrawals during monitored hours, which must be communicated to users in advance.
Efforts will also be made to maximize the proportion of user assets stored in cold wallets. Currently, the mandatory storage ratio under supervisory regulations is 80%, but the actual storage ratio among all businesses exceeds 95%.
Furthermore, the amount stored in hot wallets, which are exposed to hacking risks, will be maintained at a minimum level necessary for transactions, and the option of distributing assets across multiple hot wallets will be considered. To ensure smooth compensation for users in the event of hacking damage, the insurance compensation limits and reserve amounts will also be increased.
In the medium to long term, the FSC plans to impose security responsibilities on cryptocurrency businesses equivalent to those of financial institutions. The FSC intends to reflect obligations for ensuring IT safety and liability for damages in the Digital Asset Law currently under preparation. Even before the law is enacted, emergency response guidelines will be established to strengthen vulnerability assessments of information systems and incident reporting systems.
Additionally, security support for smaller exchanges will be expanded. Currently, only five of the 28 cryptocurrency businesses are members of the Financial Security Institute. The FSC plans to encourage the remaining businesses to join and will provide support for vulnerability assessments, sharing information on security threats, and specialized training. Separate security support will also be offered to businesses that find it difficult to join.
The Financial Security Institute plans to improve security inspection standards specifically for cryptocurrency exchanges, reflecting transaction verification and wallet access controls by the end of the year.
Vice Chairman Shin Jin-chang stated, "The awareness of security among some businesses remains at a level prior to institutionalization, contrary to the growth of the cryptocurrency market and expectations for the industry. We must establish a security system equivalent to that of existing financial institutions and fundamentally change our perception of security."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.