Mentioned in This Article
1. Bank of Korea asks banks how a crypto exchange hack would hit them
The Bank of Korea has asked 31 South Korean financial firms how a crypto exchange hack that halts the country's largest exchange would affect their business. The request went out on October 23 to 18 banks and 13 securities firms, with answers due November 4. It is the central bank's first survey of this kind, and it also covers a price slump and heavy losses at another firm.
The questionnaire treats an outage at the biggest exchange as a possible source of losses for lenders and brokers, not only for crypto traders. That framing reflects how far traditional institutions have moved toward digital assets, and how little the central bank can see of that exposure through existing reports.
This article sets out what the survey asks, why the central bank says it is collecting the data, and how recent security incidents form the backdrop to the exercise.
2. Who received the survey and what does it cover?
The recipients include some of the country's best-known lenders: KB Kookmin, Shinhan, Hana, Woori and NH NongHyup are among the 18 banks. The other 13 recipients are securities firms. The central bank has not published anything about the survey itself, so the details known so far come from its description to the press and the crypto industry.
Beyond the scenario questions, the form asks each firm about its internal crypto organization and budget, how deeply it has entered the market and what it plans next, and what is driving its interest in the sector. It also asks how the firm rates and manages crypto risk, and how much it has invested in crypto companies in South Korea and overseas.
Taken together, these questions give the central bank a picture of both capacity and exposure. Staffing and budget show how seriously a firm is committing to the business, while the investment figures show where its money is already tied to crypto companies, at home and abroad.
3. What are the three stress scenarios?
The first scenario asks what happens to a financial firm if the exchange with the largest domestic market share goes offline temporarily because of a large-scale hack or a similar incident. The exchange is not named in the questionnaire as described, and it is simply identified by its position as the market leader.
The second scenario imagines a sharp fall in bitcoin (BTC) and other crypto prices followed by a prolonged slump in trading. A downturn of that type can reduce trading volumes and fee income for firms that offer crypto services, and it can also hurt those that hold digital assets or lend against them.
The third scenario asks about heavy crypto-related losses at a different financial institution. This tests contagion, meaning whether trouble at one firm can spread to counterparties and peers through shared exposures or loss of confidence.
Stress tests of this kind are a familiar tool in banking supervision, where institutions are asked to estimate their resilience under adverse conditions. Applying the approach to crypto signals that the central bank regards the sector as large enough to matter for financial stability.
4. Why is the Bank of Korea asking now?
The central bank says it will use the responses as internal reference material. A Bank of Korea official said firms are preparing on their own while legislation covering virtual assets advances more slowly than the market had expected. In other words, institutions are building crypto businesses before the legal framework around them is settled.
A second official said the business reports that banks and brokerages submit to the Financial Supervisory Service fall short when it comes to crypto. Because of that gap, the central bank is collecting basic data directly from each firm. The statement indicates that the regular supervisory reporting does not currently capture the information the bank needs.
A third remark, made to a news agency in Korean, was that the outlook for growth in the crypto market still holds, that firms are interested in new business lines and customers, and that the bank wants to identify concerns in advance. The tone is cautious rather than hostile: the survey is presented as preparation, not as a step toward restricting activity.
5. How do recent security incidents shape the picture?
The timing is notable. The survey went out about a week before Binance reported roughly $6.3 billion in hot-wallet losses, a theft that the FBI has attributed to North Korea's TraderTraitor group. The questionnaire therefore predates that disclosure, even though its first scenario now reads as closely tied to events elsewhere in the industry.
Domestic incidents add to the context. Bithumb reportedly confirmed on October 28 that an intruder had taken personal data from an internal staff application. A separate data point comes from the Financial Services Commission, which said on October 14 that 130 of 555 financial firms reported gaps on a 12-item security checklist. Breaches were confirmed at 16 firms, two of them crypto businesses.
These figures show that security weaknesses are not limited to crypto exchanges. The checklist results cover a broad group of financial firms, and the breach count shows that incidents have already occurred. A hack that disables the largest exchange would be a more severe event, but it would arrive in a sector where gaps in security preparation have been documented.
6. How could an exchange outage reach banks and brokerages?
An exchange outage is not only a problem for the traders who cannot place orders. Financial firms that provide services around an exchange, such as holding customer deposits, offering brokerage access or taking equity stakes in crypto companies, can face losses or operational disruption when the venue stops working. The questionnaire's request for investment figures in crypto companies, both domestic and foreign, speaks to this kind of link.
When a dominant venue goes offline, liquidity does not disappear but it moves. Customers who cannot trade or withdraw may turn to other platforms, and prices on the remaining venues can swing more sharply than usual. A firm with open positions or customer commitments tied to the affected exchange could find it difficult to value assets or meet obligations during the interruption.
The scenario also tests operational preparedness. A firm that has a defined crypto organization and budget, as the questionnaire asks, is more likely to have plans for communicating with customers and managing risk during an incident than one that has only begun to explore the market.
7. Why does a market leader's outage matter more than a smaller one?
Concentration raises the stakes. The first scenario describes the exchange with the largest domestic market share, and an outage at such a venue affects a larger share of customers and transactions than one at a smaller rival. The more activity is concentrated in a single platform, the greater the consequences if it is halted by a hack.
The recent Binance theft shows the type of event that regulators have in mind. Binance reported roughly $6.3 billion in hot-wallet losses, and the incident has been a major topic across the industry. A hot wallet is a wallet connected to the internet so that an exchange can process withdrawals quickly, which makes it convenient but exposed compared with offline storage.
The Bank of Korea has not said that any South Korean exchange is at heightened risk. The survey is a planning exercise that asks firms to consider how they would cope, and the outage scenario is described as hypothetical.
8. What does the survey signal about banks and crypto?
The central bank's questions treat an outage at the largest exchange as a potential source of losses for banks and brokerages themselves. That is a notable step, since it implies that traditional firms are connected to exchanges through services, investments or customer activity, and that a disruption would not stay inside the crypto market.
The survey also follows the Bank of Korea's June Financial Stability Report, which found that crypto and traditional markets are becoming more closely linked. That report looked at the market as a whole; the new survey takes the same concern down to the level of individual firms. The progression from a market-wide analysis to firm-by-firm data collection suggests that the central bank wants a more detailed basis for its judgments.
For the firms themselves, the exercise has a practical side. Answering the questionnaire requires each institution to document its crypto organization, budget, risk ratings and investments in one place, and to think through how an exchange outage, a price slump or another firm's losses would affect it. Even before the central bank draws any conclusions, that internal review can reveal where a firm's preparation is thin.
The central bank's approach also reflects a gap between how quickly the business is developing and how slowly the rules are arriving. Without finalized legislation, supervisors rely on surveys, reports and informal channels to understand activity, and the Bank of Korea has chosen to gather its own figures instead of waiting for the legal framework to be completed.
9. What happens after the November 4 deadline?
Firms must submit their answers by November 4. The Bank of Korea has not said whether it will publish results, and the stated purpose is internal reference. The survey's findings, and any decisions that follow from them, have not been reported.
What is known is the direction of travel. South Korean banks and brokerages are preparing crypto operations, legislation for virtual assets is moving more slowly than the market expected, and the central bank is gathering its own data to fill the gap in supervisory reporting. How the responses compare with the security checklist results and the recent incidents will determine how the central bank describes the risk in future assessments.