Korean crypto exchanges on alert after $6.3 billion Binance hack

Korea’s cryptocurrency industry is on alert following a $6.3 billion hack at Binance, the world’s largest cryptocurrency exchange. As signs emerge that the stolen assets are being laundered, domestic exchanges are seeking regulatory changes that would allow them to promptly halt withdrawals following hacks at other platforms, financial authorities and industry officials said Tuesday.

The U.S. Federal Bureau of Investigation (FBI) attributed the theft to North Korea in a statement released Saturday, saying the attackers stole about $6.3 billion in cryptocurrency from Binance on Thursday.

Blockchain analytics firm Chainalysis said the North Korean hackers appeared to have entered a second stage of laundering the proceeds. Funds were being moved out of temporary holding wallets and transferred to blockchain networks such as Solana.

The firm also detected efforts to convert 970,522 Solana tokens, valued at approximately 129 billion won ($96.3 million), into bitcoin. The transfers across networks and subsequent conversion into bitcoin are believed to be aimed at making the funds harder to trace.

Amid growing concerns, the Financial Services Commission (FSC), the country’s top financial regulator, convened an emergency meeting of local cryptocurrency service providers Monday to examine the fallout for the domestic market and assess their readiness to respond.

Domestic exchanges argue that an effective emergency response requires greater clarity on when they can legally suspend withdrawals.

The Virtual Asset User Protection Act bars exchanges from arbitrarily blocking deposits and withdrawals while permitting such measures on legitimate grounds set out in a presidential decree. Industry representatives said a breach of an exchange’s own systems could warrant a suspension to safeguard customers, but the rules are less clear when the incident occurs elsewhere.

That ambiguity has raised concerns that exchanges could violate the law by freezing withdrawals as a precaution following an incident like the Binance hack. During the meeting, representatives requested more flexible rules and clearer guidance on responding to security incidents at other platforms.

Authorities also urged providers to bolster their defenses against further attacks. The Binance theft reportedly involved assets held in a hot wallet, which remains connected to the internet. Possible routes of compromise include access to internal systems through employees’ work laptops and unauthorized access to systems that approve and sign transactions.

The regulator specifically called for a larger share of assets to be stored in offline cold wallets to reduce the risk of similar breaches. Current regulations require providers to hold at least 80 percent of customers’ deposited cryptocurrency assets in cold storage.

“We will continue to strengthen our response framework in close cooperation with relevant agencies and the industry to prevent further breaches, including hacks, and limit the spread of damage,” an FSC official said.