1. Why is South Korea pushing exchanges to hold more in cold storage?
South Korea's Financial Services Commission urged the country's crypto exchanges on Monday, November 2, to keep a larger share of customer assets in offline cold wallets. The call followed an emergency meeting prompted by the roughly $6.3 billion attack on Binance the previous week, which drained funds from internet-connected hot wallets and led regulators to test how well domestic platforms would withstand a similar breach.
The reasoning is straightforward. A hot wallet stays connected to the internet so that withdrawals can be processed quickly, which also makes it reachable by attackers. A cold wallet keeps keys offline, so stealing from it generally requires physical or procedural compromise rather than a remote exploit. The more of a platform's customer holdings sit in cold storage, the smaller the sum an intruder can reach through a hot-wallet weakness.
South Korean law already sets a floor. Exchanges must keep at least 80 percent of customer crypto in cold wallets, a requirement under the country's virtual asset user protection rules. The commission's message is that meeting the minimum may no longer be enough, and that platforms should consider holding more offline.
Binance has said that the vast majority of its user assets are held in cold storage, and its funds were taken from the hot-wallet portion. That detail is central to the regulatory reading: even a platform with most assets offline can lose billions when the exposed share is large.
2. Who attended the emergency meeting?
The commission convened the session with the Financial Supervisory Service, which handles day-to-day oversight of financial firms, and the Financial Security Institute, a body focused on cybersecurity in the financial sector. Also present were the Digital Asset eXchange Alliance, known as DAXA, which brings together the country's main exchanges, and major crypto service providers.
The stated purpose was twofold: to assess what the Binance incident might mean for the local market, and to review the security arrangements of domestic exchanges. Bringing the regulator, the supervisor, the security institute and the industry group into one room reflects how seriously the authorities treated the episode.
South Korea has a large retail crypto market, and its exchanges handle substantial trading volumes in local won. A breach at a domestic platform would affect a broad base of individual users, which gives officials a reason to act quickly when a major overseas incident exposes a new pattern of attack.
3. What did regulators review?
The commission examined several areas of exchange security. These included IT access controls, the procedures used to approve withdrawals and sign transactions, and the privileges granted to administrators. Each is a point where a single compromised account or a poorly designed process can open a path for theft.
Withdrawal approval and transaction signing are especially sensitive. In many platforms a transaction needs authorization from more than one person or system before funds leave a wallet. If those steps are weak, an attacker who obtains one set of credentials may be able to move large sums. Administrator privileges raise a similar concern, since accounts with broad powers are attractive targets.
Beyond cold storage, the commission asked providers to monitor deposits and withdrawals continuously, to add staff for responding to incidents, and to report and share information on unusual access attempts promptly. Sharing such information across firms can help others spot the same attacker before funds move.
Operators were also asked to set aside additional reserves and to put in place security measures that can be applied right away. The commission said it will keep working with other agencies and with the industry to prevent further attacks and to limit damage when they occur.
4. How much do Korean exchanges hold in cold wallets today?
Actual ratios vary widely among the major exchanges, although all sit above the legal minimum. Data from the Financial Supervisory Service as of the end of September, cited by local media, showed Upbit at 99.17 percent and Bithumb at 94.76 percent. Coinone stood at 85 percent, while two smaller platforms were at 82.79 percent and 80.54 percent, only slightly above the floor.
The spread matters because the legal floor of 80 percent leaves up to one fifth of customer assets eligible to sit in hot wallets. For a large exchange, that fifth can amount to a very large sum. A platform near the minimum therefore carries a bigger exposed balance, relative to its size, than one at 99 percent.
Those numbers are a snapshot from late September and will have changed since. They also describe the share of assets rather than the strength of the controls protecting them, so a high ratio does not by itself prove that a platform is secure.
Higher cold-storage ratios carry a trade-off. Assets kept offline take longer to move, so exchanges that hold nearly everything in cold wallets must manage withdrawals and liquidity carefully. Regulators accept that cost in return for lower theft risk, but platforms must plan for the delays this can cause when customers rush to withdraw.
5. What is the difference between hot and cold wallets?
A crypto wallet is defined by how it protects the private keys that authorize spending. In a hot wallet, the keys sit on a system connected to the internet, which allows software to sign and send transactions automatically. Exchanges use hot wallets to serve customer withdrawals within minutes, since a request cannot wait for manual handling.
In a cold wallet, the keys are generated and stored on devices that are not connected to a network. Moving funds out normally involves a deliberate, multi-step process, sometimes requiring several authorized staff. The design sacrifices speed for safety, and it is the reason regulators in many countries ask exchanges to keep the bulk of customer holdings in this form.
No arrangement is entirely free of risk. Cold storage can fail through human error, insider misconduct or the loss of keys, and the process of topping up a hot wallet from cold storage creates its own exposure. The goal of a minimum ratio is therefore to limit how much is exposed at any given moment, not to promise that theft is impossible.
Security specialists also point out that the practical quality of a setup depends on details such as how keys are split among custodians, how transactions are reviewed before signing, and how quickly unusual activity triggers an alert. These are the same areas the commission examined in its review.
6. Why did regulators involve the whole industry?
The presence of the Digital Asset eXchange Alliance at the meeting reflects the way South Korea supervises its crypto market. The alliance coordinates standards among the main exchanges, including listing practices and information sharing, so measures agreed there can be applied across the sector faster than a new law could.
Including major service providers also recognizes that exchange security is not limited to the exchange itself. Custody firms, wallet technology vendors and other infrastructure providers handle keys and transactions on behalf of platforms, and a weakness in any of them can have consequences for the whole market.
The request for continuous monitoring of deposits and withdrawals fits this picture. Stolen funds are usually moved quickly through a series of addresses and platforms, and an exchange that sees suspicious deposits early can freeze them before they are converted or withdrawn. That depends on staff and systems that watch around the clock, which is why the commission asked providers to add incident-response personnel.
For smaller exchanges, these expectations may be costly. Hiring security staff and holding additional reserves requires resources, and the platforms closest to the legal minimum on cold storage may face the largest adjustment. How the commission treats firms of different sizes will be an important detail as the guidance is put into practice.
7. What lessons does the Binance attack offer?
The Binance incident showed that scale alone does not protect an exchange. Even a platform with the great majority of customer funds offline lost roughly $6.3 billion from its hot wallets, and it has said it found no evidence of a leak of wallet private keys. The episode places attention on how hot wallets are sized, monitored and limited.
For exchanges, one practical response is to cap the balance a hot wallet can hold, topping it up only as needed. Another is to apply limits and delays to large outgoing transfers, giving staff a window to detect abnormal activity. Neither removes risk, but both reduce the amount an attacker can take before defenses react.
For regulators, the case raises the question of whether fixed percentages are the right instrument. A rule that sets a minimum share offline is simple to check, yet it says nothing about absolute amounts. The commission's decision to ask for more than the legal minimum suggests that supervisors are weighing whether stricter or more detailed requirements may follow.
8. What happens next?
The commission has not announced a new numeric requirement. Its request for higher cold-wallet holdings, extra reserves and faster information sharing is, for now, guidance to the industry rather than a change to the law. Exchanges will need to decide how far to go on their own and how to explain their choices to users.
Observers will look for the next Financial Supervisory Service data to see whether ratios rise, especially at the platforms nearest the 80 percent floor. They will also watch for any follow-up from the commission, including formal rule changes or inspections of exchanges' withdrawal and signing procedures.
The outcome will matter beyond South Korea. Regulators in other jurisdictions are studying the same breach, and a clear domestic response could become a reference point. For users, the practical takeaway is that reserve ratios and security procedures are now an explicit supervisory priority, and the platforms they use are being asked to show how those protections work.