After receiving threats from hackers, South Korean cryptocurrency exchange GOPAX suspended cryptocurrency trading, deposits, and standard withdrawals, and as a preventive measure, transferred customers' assets to offline wallets.
According to the official announcement from GOPAX, the exchange ceased deposit and standard withdrawal services on November 6th at 2:55 PM local time (5:55 UTC time). Trading services were also suspended at 3:53 PM (6:53 UTC time), and the exchange cancelled all unexecuted orders at the same time.
The company stated that it will transfer its cryptocurrency holdings to cold wallets, which do not require a direct connection to the internet to function. Customers can still apply for withdrawals through the customer service center, but each application must be manually verified and approved before processing.
GOPAX confirmed receiving hacker threats, but claimed that no actual attacks or attempts to steal customer assets were detected when the service was halted.
GOPAX A company representative confirmed in an interview with the South Korean newspaper "Gyeongxiang News" that they received this threatening email, but stated that no hacking activities occurred at that time.
The exchange stated that this measure is a preventive action taken to protect customers' funds during the assessment of potential security risks. No timeline for resuming normal trading, recharging, or withdrawals has been announced yet.
Under temporary arrangements, customers are unable to directly withdraw cryptocurrencies through the GOPAX website or mobile app. Instead, they must contact customer support and submit a separate withdrawal request.
After submission, the exchange will review each application through its internal verification and approval process. GOPAX warns that since staff members must process each application individually, the processing time may be longer than usual.
This suspension has affected customers' ability to trade and transfer funds through regular channels, however, the company has not reported any losses of cryptocurrencies related to this threatening email.
As of the time of publication, GOPAX has not responded to crypto.news's request for a comment.
After receiving threats, GOPAX began to transfer assets from online hot wallets to cold storage, and took further measures to suspend transactions during the transfer period.
Cold wallets allow exchanges to hold cryptocurrencies without keeping the relevant signing keys continuously accessible through online systems. Hot wallets, on the other hand, are convenient for handling daily transactions, but their connectivity also brings additional security risks.
The exchange's decision is in line with the directives of the Korean Financial Services Commission ( FSC ). The institution recently called on domestic crypto platforms to strengthen security measures.
According to previous reports by crypto.news, on November 2, following a $6.3 billion security incident at Binance, regulatory authorities held an emergency meeting with major exchanges.
Officials reviewed the withdrawal approval system, administrator permissions, internal access control, and transaction monitoring procedures. Subsequently, they urged the exchange to save more customer assets offline and to enhance its ability to respond to suspicious transactions.
According to South Korea's "Virtual Asset User Protection Act," exchanges are required to store at least 80% of the economic value of customers' encrypted assets in cold storage.
Data from the Financial Services Commission of South Korea shows that as of the end of September, GOPAX had offline stored 80.54% of its customer assets, which is relatively close to the minimum regulatory requirements.
During the same period, other large exchanges maintained a higher proportion. The cold storage ratio of Upbit was 99.17%, that of Bithumb was 94.76%, and that of Coinone was 85%.
South Korean authorities have been considering raising the minimum cold storage requirement to as high as 99%, but no final decision has been announced yet, nor have any new mandatory thresholds been introduced.
The suspension of GOPAX occurred after a series of cybersecurity incidents on South Korean cryptocurrency platforms and financial institutions.
FSC The latest security review stems from the Binance attack on October 29th. This incident resulted in the theft of approximately $6.3 billion in cryptocurrencies and prompted various exchanges to re-examine their methods of protecting customer assets.
This incident has once again drawn attention to the security of hot wallets, and several trading platforms have also explained how they isolate customer funds from connected systems.
In related developments, Coinbase explained its security measures, stating that its systems and customer assets were not affected by the Binance incident. It is reported that the exchange stores over 99% of its customers' encrypted assets in cold storage.
South Korean regulatory authorities are also reviewing recent data breach incidents involving cryptocurrency businesses and traditional financial institutions.
GOPAX itself reported a customer information leak in October, due to the discovery of abnormal access to certain accounts. This incident resulted in the exposure of personal information of 7 customers and 2 current or former employees.
Authorities have not yet confirmed whether the latest threatening email is related to previous incidents.
Another South Korean cryptocurrency exchange, Prabang, suspended its services on October 24 after detecting abnormal withdrawals from hot wallets.
The platform subsequently reported a loss of about 100 million Korean won (approximately $70,000) and stated that it would use company funds to compensate the affected customers.
GOPAX has not yet announced a date for resuming normal services, and currently, customers are directed to the customer service center to submit withdrawal requests for manual processing.
