South Korea’s GOPAX halts crypto trading, withdrawals after hacking threat

South Korean cryptocurrency exchange GOPAX has suspended trading, deposits and standard withdrawals after receiving a hacking threat, prompting the company to move customer assets into offline wallets as a precaution.

According to GOPAX’s official notices, the exchange stopped deposits and standard withdrawals at 2:55 p.m. local time (5:55 a.m. UTC) on November 6. Trading services were suspended at 3:53 p.m. (6:53 a.m. UTC), with the exchange canceling all outstanding orders.

The company said it would transfer its cryptocurrency holdings to cold wallets, which operate without a direct internet connection. Customers can still request withdrawals through the support center, although each request requires manual checks and approval before processing.

GOPAX confirms hacking threat but reports no stolen funds

The suspension followed an email threatening to compromise the exchange, although GOPAX said it had not detected an actual attack or an attempt to steal customer assets.

Speaking to South Korean newspaper Kyunghyang Shinmun, a company representative confirmed receiving the threatening message but said no hacking activity had taken place at the time.

The exchange described its decision as a preventive measure intended to protect customer funds while it reviewed potential security risks. It has not announced when regular trading, deposits or withdrawals will resume.

Under the temporary arrangements, customers cannot withdraw cryptocurrency directly through the GOPAX website or mobile application. Instead, they must contact customer support and submit a separate withdrawal request.

Once submitted, the exchange will review each application through its internal verification and approval procedures. GOPAX warned that processing could take longer than usual because staff must handle requests individually.

The shutdown has affected customers’ ability to trade and move funds through regular channels, although the company has not reported any loss of cryptocurrency connected to the threatening email.

GOPAX did not respond to a request for comment from crypto.news by press time.

GOPAX moves crypto holdings into cold storage

Following the threat, GOPAX began moving assets from internet-connected hot wallets into cold storage, taking the additional step of suspending trading while the transfer takes place.

Cold wallets allow exchanges to hold cryptocurrency without keeping the associated signing keys continuously accessible through online systems. Hot wallets remain useful for handling routine transactions, but their internet connectivity can create additional security exposure.

The exchange’s decision follows instructions from South Korea’s Financial Services Commission (FSC), which recently called on domestic cryptocurrency platforms to strengthen their security arrangements.

As crypto.news previously reported, the regulator held an emergency meeting with major exchanges on November 2 following the $6.3 billion Binance security incident.

Officials reviewed withdrawal approval systems, administrator privileges, internal access controls and transaction monitoring procedures. They subsequently urged exchanges to keep more customer assets offline and improve their ability to respond to suspicious transactions.

Under South Korea’s Virtual Asset User Protection Act, exchanges must hold at least 80% of the economic value of customer cryptocurrency assets in cold storage.

Financial Supervisory Service data showed that GOPAX held 80.54% of customer assets offline at the end of September, leaving the exchange relatively close to the regulatory minimum.

Other major exchanges maintained higher ratios during the same period. Upbit held 99.17% of customer assets in cold storage, followed by Bithumb at 94.76% and Coinone at 85%.

South Korean authorities have been considering raising the minimum cold-storage requirement to as much as 99%, although they have not announced a final decision or introduced a new mandatory threshold.

South Korea strengthens exchange security after Binance hack

GOPAX’s suspension follows a series of cybersecurity incidents involving cryptocurrency platforms and financial institutions in South Korea.

The FSC’s latest security review followed the October 29 Binance attack, which resulted in approximately $6.3 billion in stolen cryptocurrency and prompted exchanges to review how they protect customer assets.

The incident renewed attention on hot-wallet security, with several trading platforms explaining how they separate customer funds from systems connected to the internet.

In a related development, Coinbase outlined its safeguards, saying its systems and customer assets remained unaffected by the Binance breach. The exchange reportedly maintains more than 99% of customer cryptocurrency assets in cold storage.

South Korean regulators have also been examining recent financial data breaches involving cryptocurrency businesses and traditional financial institutions.

GOPAX itself reported a customer information leak in October after detecting abnormal access to certain accounts. The incident exposed personal information belonging to seven customers and two current or former employees.

Authorities have not established whether the latest threatening email is connected to that earlier incident.

Another South Korean cryptocurrency exchange, Prabang, suspended services after detecting unusual withdrawals from its hot wallet on October 24.

The platform subsequently reported losses of approximately 100 million won ($70,000) and said it would reimburse affected customers using company funds.

GOPAX has not disclosed a date for restoring its regular services, with customers currently directed to its support center for manually processed withdrawal requests.