1. Gopax Halts Trading After Receiving Hacking Threats
Gopax, a South Korean cryptocurrency exchange, suspended trading as well as deposit and withdrawal services on November 6 after it received threats of a possible hacking attack. Deposits and withdrawals were stopped at 2:55 p.m. local time, and trading followed at 3:53 p.m. The exchange said the measures are preventive and are meant to protect customer funds while it reinforces its security systems.
The sequence is worth noting. Money movement was frozen first, which closes the most direct route by which an attacker could drain assets, and the order book was halted roughly an hour later. Together the two steps take the exchange's core functions offline, which is a drastic move for a trading venue and one that exchanges usually avoid unless they judge the risk to be serious.
The announcement describes a precaution rather than a confirmed breach. The company did not say that funds had been taken. It described the shutdown as a step taken in response to a threat, and it said it is working to strengthen its protections before normal service returns.
Temporary suspensions of this kind are not unusual in the industry's history. Exchanges have halted deposits and withdrawals after detecting suspicious activity, during maintenance and while investigating incidents, and the practice is generally seen as a way to limit losses while a problem is understood. The cost falls on customers, who cannot trade or move funds, so operators try to keep such pauses as short as they can.
2. What Is Gopax Doing With Customer Assets?
Gopax plans to move all virtual assets held for customers into offline cold wallets. A cold wallet keeps its private keys on a device or system that is not connected to the internet, so an attacker who breaks into the exchange's online systems cannot reach the funds by that route. A hot wallet, by contrast, stays connected so that withdrawals can be processed quickly.
Exchanges normally keep a share of customer assets in hot wallets to meet everyday withdrawal demand and store the remainder offline. Moving everything offline removes that convenience in exchange for a much smaller attack surface, which explains why withdrawals through the usual channels have been suspended while the transfer is carried out.
The decision to relocate all customer holdings, rather than only a portion, signals how seriously the company is treating the threat. It also means the exchange cannot simply flip a switch to resume service; assets will need to be moved back or processed manually once it decides conditions are safe.
Security teams usually respond to a credible threat in layers: they cut off the avenues through which assets can leave, review access credentials, check the integrity of the systems that sign transactions and watch for abnormal behavior. Moving assets offline is the strongest of these measures because it separates funds from the networked systems an attacker would have to compromise.
3. How Can Customers Withdraw Funds Now?
Customers cannot withdraw through the Gopax website or mobile app while the suspension lasts. The exchange is instead accepting withdrawal requests through its customer service center. Each request goes through manual review and approval, so it may take longer than a standard withdrawal.
For users, that means access to their assets is possible but slower and subject to checks. A manual process lets the exchange verify who is asking and where the funds are going at a time when it is concerned about malicious activity, though it also creates a queue that could grow if many customers ask at once.
The company has not been quoted giving a time at which trading or normal withdrawals will resume. Customers who need to move funds in the meantime are therefore dependent on the support channel and on the exchange's review pace.
Manual handling has a clear logic from a security standpoint. Automated withdrawal systems are the very mechanism an attacker would try to abuse, so replacing them with human review means each outgoing transfer can be examined individually. The price is speed, and the exchange has said openly that these requests will take longer than regular ones.
4. Why Does the Halt Follow a Run of Security Incidents?
The suspension arrives amid several security problems in South Korea's crypto and financial sectors over the past two weeks. On October 24, Pravang reported the theft of about 100 million won in virtual assets. On October 27, Bithumb suffered a data breach affecting 6,444 customers and 715 employees.
On October 29, Binance was hit by a hacking incident that carries reported damages of about $6.3 billion, and that episode has intensified broader concerns about the safety of exchanges. Each of these events differs in size and kind, ranging from an asset theft to a leak of personal data to a record-scale heist, but taken together they have put exchange security under close scrutiny.
Against that background, a threat against any platform is likely to be taken seriously. Operators know that an attack on one venue can quickly raise doubts about others, and a pre-emptive shutdown may be preferred to the reputational and financial damage of a successful intrusion.
The reference to the sector's recent run of incidents also reflects how interconnected exchange risk can be. A theft at one venue, a data leak at another and a very large exploit at a third are different kinds of events, but they all raise the same question for customers and regulators: whether platforms hold enough protection against determined, well-organized attackers.
The Bithumb figure shows a different kind of exposure. A breach affecting 6,444 customers and 715 employees involves personal information rather than coins, yet such data can later be used to target people with phishing or impersonation. Security specialists therefore treat leaks of customer and staff details as a risk in their own right and not merely as an inconvenience.
5. How Important Is Gopax in the South Korean Market?
Gopax is counted among South Korea's five main won-denominated exchanges, together with Upbit, Bithumb, Coinone and Korbit. A won-denominated exchange lets customers trade crypto directly against the South Korean currency, which is the basis of the country's retail crypto market.
Despite that ranking, its footprint is small. Gopax accounts for only 0.01% to 0.02% of domestic trading volume, so the suspension is unlikely to disrupt overall market activity in a visible way. Its significance lies more in what it shows about the pressure on exchanges than in its size.
Binance holds roughly 67% of Gopax's shares and is its largest shareholder. That link places the exchange close to the company at the center of the October 29 incident, although the report on the halt does not say that the threat Gopax received is connected to it.
Size and importance are different questions. A venue with a tiny share of trading can still hold meaningful customer balances, and a successful attack on it would harm those customers regardless of how little of the market's volume it handles. That is one reason regulators and operators treat security failures at small exchanges as seriously as those at large ones.
6. What Is Known and Not Known About the Threat?
Several important details have not been disclosed. The announcement does not identify who made the hacking threats, how they were delivered or what they demanded. It also does not name the financial authorities whose recommendations the exchange says it followed when it took its preventive steps.
That leaves open whether the episode is an isolated threat or part of a wider pattern aimed at South Korean platforms. Without that information, outside observers can only record what the company has done and when, not judge how credible the threat was.
The gaps matter for customers, because the exchange's plan to wait before resuming service depends on its own assessment of the danger. Until Gopax publishes more, users have to rely on its statement that the steps are precautionary and intended to protect their assets.
The company's phrasing, which stresses prevention, suggests that it believes no loss has yet occurred. Still, the announcement does not provide a technical description of the threat, and the exchange has not said what evidence it holds. Readers should treat the situation as developing and rely on later statements from the company for confirmation of any change.
7. What Should Gopax Customers Expect Next?
The exchange has not announced a restart date for trading, deposits or withdrawals. The next developments to watch are the completion of the move of customer assets into cold wallets, any further statement describing the nature of the threat, and an announcement of when services will return.
Users with funds on the platform can submit requests through the customer service center and should expect delays while manual review is in place. Those who do not need to move assets may prefer to wait for the exchange to confirm that its security work is finished.
The episode also adds to pressure on South Korean exchanges to show that their defenses are adequate after a series of incidents in rapid succession. How Gopax handles the process, and how openly it explains the result, will help shape customer confidence in the platform.
For ordinary users, the general lesson drawn after such episodes is familiar. Assets left on an exchange are exposed to the exchange's own security, and customers depend on the operator's controls, procedures and honesty during a crisis. The Gopax shutdown is an example of an operator choosing to prioritize those controls over uninterrupted service.
In the longer term, the episode may encourage exchanges to rehearse emergency procedures such as the one Gopax is now carrying out. Being able to take trading offline, move assets into cold storage and run a manual withdrawal process quickly is a test of preparedness, and customers are likely to ask how well each platform would perform if a similar threat reached it.