FSC orders crypto exchanges to boost cold-wallet custody after Binance hack

South Korea’s Financial Services Commission (FSC) requested domestic crypto exchanges to increase cold-wallet custody and strengthen operational safeguards following the Oct. 30 Binance hack. The regulator issued these directives at an emergency meeting held at 10 a.m. on Nov. 2, as confirmed by a Nov. 3 clarification.

Emergency meeting details

The Nov. 2 meeting brought together the FSC, the Financial Supervisory Service, the Financial Security Institute, a crypto industry association, and major virtual-asset businesses. The session focused on immediate protective measures for customer assets and operational security. The FSC stated that it immediately requested the safeguards at this meeting to address the risks highlighted by the recent security incident at Binance.

Participants examined specific controls over access to computer systems, including approval and signing arrangements for wallet withdrawals and administrator privileges. These technical reviews extended the scope of the discussion beyond the percentage of assets held offline to the specific systems and permissions used to move digital assets.

Specific regulatory requests

The FSC urged operators to implement five key measures. First, exchanges were asked to increase the proportion of customer assets held in cold wallets. Second, operators must continuously monitor deposits and withdrawals. Third, the regulator requested that exchanges secure additional response staff to handle potential security incidents. Fourth, operators are required to promptly report and share information regarding abnormal access attempts. Finally, the FSC directed exchanges to build additional financial reserves.

These requests build on a custody framework adopted in 2024. The FSC’s July 2024 supervision-regulation notice, which accompanied the legal framework taking effect on July 19, 2024, set the customer-asset cold-wallet share at 80% of defined economic value. The notice defined cold storage as keeping assets separated from the internet. It also established standards for insurance, mutual-aid coverage, or reserves to meet liabilities arising from incidents such as hacking and computer failures.

The 80% ratio remains the existing 2024 standard and was not presented as a newly announced threshold in the November releases. The calculation for this ratio multiplies each asset type’s quantity by its preceding-year average won conversion value, then adds the amounts to determine the total economic value subject to the custody requirement.

On Oct. 28, regulators began on-site inspections after Bithumb reported signs of an employee-information leak. The Nov. 2 meeting addressed the subsequent response to the Binance hack and the broader safeguards sought across domestic operators. Neither the Nov. 2 release nor the Nov. 3 clarification specifies a new numerical cold-wallet threshold, an additional reserve amount, or exchange-by-exchange implementation results.