South Korea plans stricter rules for crypto exchanges

South Korea’s government is planning stricter rules on cryptocurrency exchanges after a recent hack at Upbit, a Seoul-based exchange run by Dunamu.

Authorities want to introduce bank-level, no-fault compensation, requiring exchanges to cover user losses from hacks or system failures, regardless of fault.

This standard currently applies only to banks and electronic payment firms in Korea.

The move follows a November 27 breach that reported 44.5 billion won (US$30.1 million) in Solana-based coins moved from Upbit to external wallets in under an hour.

Regulators could not order compensation for affected users under existing laws.

The Financial Services Commission is reviewing measures to make exchanges liable, set mandatory IT security requirements, higher standards for systems and staff, and tougher penalties.

Lawmakers are considering raising the maximum fine for exchanges from 5 billion won (US$3.4 million) to 3% of annual revenue, matching financial institutions.

🔗 Source: The Korea Times

🧠 Food for thought

Implications, context, and why it matters.

Korea’s crypto compensation law still lacks implementation details and timeline

The government is weighing bank-level liability for crypto platforms, which would make them compensate users for hacks or outages regardless of fault, but no draft amendment has been released 1. The Financial Services Commission supervises Virtual Asset Service Providers (VASPs) and can impose penalties 2. The Electronic Financial Transactions Act, the main law for electronic payments, does not treat these firms like banks 1.
Lawmakers target a stablecoin bill (a crypto token designed to track a fiat currency) by December 10, with debate in January 2026, while the liability plan sits apart 3. Trading firms face talked-about rules not yet in force, adding uncertainty for security budgets.

Insurance providers and custody vendors face urgent demand from Korean exchanges

Under the Act on the Protection of Virtual Asset Users, Korean platforms must hold insurance or reserves covering at least 5% of customer assets in hot wallets (internet-connected storage), and Korean won (KRW) venues need a minimum of 3 billion won 4. Samsung Fire & Marine Insurance and KB Insurance launched VASP policies in July 2024, with Korean Re (a reinsurer) helping set premiums 5.
Platforms must keep 80% of customer assets in cold wallets (offline storage), which creates demand for custody solution providers (third-party digital asset storage firms) and security vendors (cybersecurity providers) serving Korea’s five major venues, plus smaller operators 4. Insurers can use standardized clauses cleared by the Financial Supervisory Service, Korea’s financial watchdog, to expand reach 5.