Crypto exchanges will be able to block deposits and withdrawals first, at the stage when they detect signs of a hack. Financial authorities plan to require exchanges to set up 24-hour security monitoring and to increase the share of customer assets held in cold wallets. They also plan to impose information technology (IT) safety obligations and liability for damages on par with financial companies through the Digital Asset Act.
The Financial Services Commission held a “Virtual Asset Industry Security Response Meeting” at the Government Complex Seoul on the 12th. Vice Chairman Shin Jin-chang presided over the meeting. Officials from the Financial Supervisory Service, the Korea Financial Security Institute and major exchanges and custodians attended. The meeting followed a string of breaches, including a recent hack of Binance, the world’s largest exchange.
Authorities judged that, even as the market has grown rapidly, some operators’ security levels have failed to keep pace. As of the 5th, the market capitalization of crypto assets on domestic exchanges stood at 66 trillion won. Daily trading volume was 1.9 trillion won. The number of users able to trade was about 10.02 million, including duplicates. Meanwhile, virtual asset service providers are not subject to the security rules under the current Electronic Financial Transactions Act.
The key point is permission for preemptive blocking of deposits and withdrawals. The current Virtual Asset User Protection Act prohibits blocking without justifiable grounds. It recognizes blocking only when a hack has clearly occurred. As a result, concerns have been raised that it is unclear whether operators can block in advance even when signs of abnormal transactions appear. The FSC will issue a “no-action letter” stating that it will not impose sanctions even if operators block under certain conditions.
It also requires round-the-clock monitoring and response systems suited to a market that runs without holidays. In situations of suspected breaches, such as abnormal large-scale transactions, operators must take control measures immediately. Operators that find 24-hour monitoring difficult must process deposits and withdrawals only during hours when they can respond, and must notify users in advance.
Asset custody standards will also be raised. Under the Virtual Asset Business Supervision Regulation, the mandatory cold-wallet storage ratio is at least 80%. The actual share held by operators already exceeds 95%. Authorities plan to push that share as high as possible and to encourage operators to keep only the minimum amount necessary for trading in hot wallets. A proposal to split hot-wallet assets across multiple wallets was also put forward. Operators were also told to raise insurance coverage limits and reserve accumulations to compensate for hacking losses.
Support through the Korea Financial Security Institute will also be expanded. Of the 28 domestic virtual asset service providers, only five Korean won-market exchanges are members of the institute. Authorities plan to have the remaining operators pursue membership, taking into account factors such as user numbers. Member firms will receive services such as sharing of breach-threat information, vulnerability inspections and specialized training. For small and mid-sized operators that find it hard to join, authorities will help with vulnerability detection and building security alert systems.
Exchange-specific security inspection standards will be revised within the year. They will cover risk factors that differ from those of existing financial companies, such as blockchain, electronic wallets and smart contracts. External expert inspections will also be increased.
Because legislation takes time, authorities plan to first draw up an “Emergency Response Guideline for Virtual Asset Operator Security Incidents” and implement the measures that can be taken right away.
“Some operators’ awareness of security still remains at the pre-institutionalization stage,” Vice Chairman Shin said, adding, “Strengthening security to the industry’s highest level is not an issue that can wait for legislation alone.” He added, “Since virtual asset operators take custody of and manage users’ assets, they need to have a security system at the same level as traditional financial companies.”