South Korea's FSC Orders Cold Wallet Raise After $6.3B Binance Hot Wallet Hack

FSC Convenes Emergency Session Over Binance Breach

South Korea's Financial Services Commission (FSC) convened an emergency review on Monday, November 2, and ordered domestic virtual asset operators to raise cold wallet ratios and add to reserves in the wake of the Binance hot wallet breach. The session ran under digital financial policy officer Yu Yeong-jun and brought in the Financial Supervisory Service, the Financial Security Institute, the Digital Asset Exchange Alliance (DAXA) and the country's major operators. It was the regulator's first coordinated sit-down with the industry since the breach was disclosed, and its readout was published the same morning. Participants assessed how the incident could spill into the domestic market and checked each operator's response setup. The inspection covered access control across internal systems, the withdrawal approval and signing framework for hot wallets, and the handling of administrator privileges. The regulator then asked operators for steps it described as immediately executable: lifting the share of assets held in cold storage, monitoring deposits and withdrawals around the clock, securing additional response personnel, and reporting or sharing abnormal access attempts without delay. It also requested extra reserve accumulation on top of existing holdings. The commission said it will keep strengthening its response framework with related agencies and the industry to prevent further intrusion incidents and stop any damage from spreading. The trigger was Binance's October 30 disclosure that roughly $6.3 billion, about 8 trillion won, in virtual assets had left a hot wallet without authorization. The exchange said it moved at once to trace and freeze the taken assets and committed to covering user losses in full from company funds. Neither the exchange nor the regulator has published a final loss figure net of freezes, a gap the reserve request is meant to narrow. The breach turned operator readiness, rather than market direction, into the question Seoul is now pressing.

Suspected Entry Through an Employee Laptop

The suspected entry paths point to operational security rather than any on-chain weakness. In its press materials the commission said two possibilities are under review: an employee's work laptop was compromised, opening a route into internal systems, and the transaction approval and signing layer saw unauthorized access. A compromise of that kind would echo earlier exchange incidents in which a single privileged endpoint reached withdrawal infrastructure. The second path is where blind signing becomes the exposure. An approval system that signs what it is handed, without an operator verifying each transfer detail on a separate trusted screen, lets one compromised machine command outgoing withdrawals across a treasury. Domestic preparedness varies widely. Disclosure data compiled in the Korean market shows the gap between insurance coverage and incident reserves reaches 26.7 times between operators at the top and bottom of the range, a spread the commission reviewed company by company during the session, alongside each operator's insurance subscription and reserve accumulation status. The commission also weighed whether a similar asymmetry exists in cold wallet holdings, though it did not publish per-operator figures. For readers comparing venues, COINOTAG's Best Crypto Exchanges overview tracks custody structure, reserve policy and incident history side by side. No attacker wallet addresses or transaction hashes have been published, so the outflow cannot yet be independently verified on-chain. The exchange's own announcement remains the only primary account of the movement, and Seoul has not confirmed which of the two suspected paths applied. Until a post-mortem lands, the enforced fixes stay structural: more cold storage, tighter signing control and thicker reserves. The commission has not set a deadline for operators to report back on the requested measures. It said coordination with related agencies and the industry would continue to prevent copycat intrusions.

For COINOTAG, the commission is treating the breach as an operations failure rather than a market event, and its response targets structure, not blame. Two moves stand out. Asking for extra reserves effectively imports the exchange's full-coverage promise into a domestic benchmark, shifting incident cost from users onto operator balance sheets. And by pressing on approval and signing systems, the regulator is hardening the same layer where the suspected unauthorized access occurred, before any post-mortem confirms which path was used. Reserve requirements, unlike capital rules, can be met in weeks, so compliance may surface in operator disclosures within the quarter. The next data point is whether DAXA members begin publishing cold wallet ratios and reserve levels on a fixed schedule.