Korean Exchange Prabang Suspends Services After Hack Costing About 100 Million Won

Prabang Suspends Services After Hot Wallet Breach

South Korean digital asset exchange Prabang has suspended its services after an external intrusion produced abnormal withdrawals, with losses confirmed so far at roughly 100 million won. The company laid out the timeline in its official notice: the breach occurred around October 24, when an unauthorized party gained access to its systems. Staff detected the irregular outflows leaving the exchange's hot wallet, the internet-connected crypto wallet an exchange keeps funded to process customer withdrawals, and immediately activated its emergency response framework. A full inspection of company systems followed. During that review Prabang identified a security vulnerability, and management chose to shut the service down rather than keep trading live while the investigation ran. The incident was also reported to the relevant authorities, and the exchange says the exact cause and the final scale of the damage remain under investigation. Access is currently impossible: as of Thursday morning, October 29, both the Prabang homepage and its privacy policy page returned 503 Service Unavailable responses, leaving members unable to log in, trade or withdraw. No technical post-mortem has been published. The exchange has not said which systems the attacker touched, which assets were taken, or whether the funds left in one transaction or several. The 100 million won figure is therefore a floor rather than a final number, and Prabang has stated the precise damage will be confirmed only after the affected assets are fully identified. Detection of the abnormal outflows on October 24 means the window between compromise and lockdown was short, though the company has not confirmed when access was first gained.

Full Repayment Pledge as Sector Concerns Grow

Prabang has committed to making members whole from its own balance sheet. The confirmed damage currently stands at about 100 million won, and the company said it will cover the entire amount with corporate assets once the affected holdings have been precisely identified. It apologized to users, promised to strengthen security and upgrade its systems to prevent a recurrence, and said any newly confirmed details will be communicated to members directly. What it has not offered is a timeline: no service resumption date, no description of the vulnerability itself, and no account of how the initial unauthorized access was obtained. The breach lands at a sensitive moment for the Korean market. Security incidents have recently been confirmed at Bithumb and at Streami, the operator of GOPAX, and concern over security management across the industry has grown accordingly. Related disclosures indicate both GOPAX and Prabang have separately apologized over customer information leak incidents, adding a data-protection layer to the operational questions now open. The response sequence Prabang has described is orderly on its face: abnormal hot wallet outflows detected, emergency protocol activated, system-wide inspection, vulnerability identified, service suspended, authorities notified. That is the playbook executing after the fact. The unresolved questions sit upstream of it. The exchange has not disclosed where the withdrawn assets went, including whether they were routed through a crypto mixer or shifted across cross-chain bridges, either of which would complicate recovery and tracing. A company-funded reimbursement works here because the loss is small; the same pledge would not scale to a nine-figure breach.

Our reading: the structure of this incident matters more than its size. The loss stayed near 100 million won because the abnormal outflows were caught early and the platform was locked down, which suggests withdrawal monitoring did its job even though the perimeter did not. Paying compensation from corporate assets is credible precisely because the amount is modest. Three Korean venues reporting security incidents within a matter of weeks points to a shared weakness in custody and access controls rather than isolated bad luck. Watch for three things next: Prabang's technical disclosure on the vulnerability, confirmation of where the drained funds went, and a firm relaunch date. For users weighing platforms in the meantime, our overview of the best crypto exchanges covers the security and custody records that should sit at the center of that choice.