Virtual Asset Service Providers will be mandated to secure information technology safety equivalent to that of traditional financial companies, and a pathway will be opened for exchanges to preemptively block deposits and withdrawals even at the stage where a hacking incident is suspected.
The Financial Services Commission held a Virtual Asset Industry Security Countermeasures Meeting presided over by Vice Chairman Shin Jin-chang on Nov. 12 to discuss the current status of infringement incidents involving Virtual Asset Service Providers and measures to strengthen security.
The meeting was attended by the Financial Supervisory Service, the Financial Security Institute, and the Digital Asset eXchange Alliance, along with five won-market exchanges including Dunamu, Bithumb, Coinone, Digital X, and Streami; four coin-market exchanges including Korea Digital Exchange, Foblegate, Happyblock, and Guardian Holdings; and two custody service providers including Korea Digital Asset and Korea Digital Asset Custody.
During the meeting, Financial Services Commission Vice Chairman Shin Jin-chang pointed out the current status of successive information leaks and infringement incidents in the virtual asset industry, stating, “The security awareness of some service providers remains in the pre-institutionalization stage, contrary to the growth of the virtual asset market and expectations for the industry.”
He further urged, “Given that Virtual Asset Service Providers are entrusted to store and manage users’ assets, they require a security system of the same level as traditional financial companies.”
The financial authorities plan to include provisions in the Digital Asset Act (draft) currently under preparation that will require digital asset service providers, currently known as Virtual Asset Service Providers, to fulfill information technology safety obligations and damage compensation liabilities equivalent to those of financial companies.
However, as the enactment of the law will take time, the authorities have decided to first implement the Virtual Asset Service Provider Security Incident Emergency Response Guidelines, which can be executed immediately at the current stage prior to legislation.
In accordance with the guidelines, Virtual Asset Service Providers must deploy dedicated personnel at all times to align with the characteristics of a market where trading occurs 24 hours a day, and they must implement immediate control measures when an incident, such as an abnormal large-scale transaction, is suspected to have occurred.
Service providers that face difficulties in operating a continuous monitoring and response system must process deposits and withdrawals only during the hours when the said system operates normally, and they must notify users of this in advance while deploying personnel to respond to deposit and withdrawal requests in a timely manner.
Management standards and compensation resources for cold wallets, which are virtual asset wallets stored separately from the internet to protect user assets, will also be strengthened. Under the current Regulation on Supervision of Virtual Asset Business, the mandatory cold wallet storage ratio for service providers is 80%, while the actual storage ratio across all service providers records over 95%.
In addition to this, the authorities proposed measures to maintain the volume stored in online-connected hot wallets at the minimum quantity necessary to support trading and to distribute the storage across multiple hot wallets. To ensure smooth compensation in the event of hacking damages, the insurance compensation limits and reserve accumulation amounts have also been mandated to be expanded.
Furthermore, in alignment with the standards applied to financial companies under the Electronic Financial Transactions Act, service providers are required to expand information technology and information protection personnel and facilities, establish technical, managerial, and physical safety standards, and execute vulnerability analysis, evaluation, and supplementary measures for information processing systems and information and communications networks.
An incident reporting system will also be established to immediately notify financial authorities when an infringement incident occurs or when the possibility of an infringement, such as an external abnormal access attempt, is discovered.
In particular, preemptive measures to block deposits and withdrawals to prevent the spread of hacking incidents will also be permitted. The current Act on the Protection of Virtual Asset Users prohibits the blocking of deposits and withdrawals without justifiable grounds and allows blocking only when the occurrence of a hacking incident is evident, which led to industry criticism that it was unclear whether preemptive blocking was possible at the stage of hacking suspicion, such as during abnormal transactions.
Considering that swift blocking measures are decisive in minimizing damages, as confirmed in cases like the Binance hacking incident, the financial authorities have decided to issue a no-action letter to allow preemptive blocking of deposits and withdrawals under certain conditions when a hacking or infringement incident is suspected.
Efforts to expand membership in the Financial Security Institute and support security inspections will also be promoted to elevate the security capabilities of small and medium-sized Virtual Asset Service Providers.
As of the present, among the total 28 Virtual Asset Service Providers, only five won-market exchanges have completed membership registration with the Financial Security Institute due to reasons such as user scale and membership fee burdens.
The authorities plan to promote additional membership for the remaining service providers by considering their usage scale and to provide infringement threat information sharing, security vulnerability inspections, and specialized financial security training. For service providers that face difficulties in joining as members, support will be provided for vulnerability detection, warning systems, and security measures at the level of small and medium-sized financial companies.
Meanwhile, to fill the external inspection gap for Virtual Asset Service Providers, who have been excluded from the vulnerability analysis and evaluation targets under the Electronic Financial Transactions Act aside from the Information Security Management System certification under the Act on Reporting and Using Specified Financial Transaction Information, the authorities plan to improve and distribute the Virtual Asset Exchange Specialized Security Inspection Standards by the end of this year.
Reflecting an operational environment different from traditional financial companies, such as cloud-centric operations and the threat of hot wallet hijacking, separate inspection standards will be established for areas including transaction verification enhancement, wallet access control, virtual asset compliance, blockchain, and smart contracts.
The Financial Security Institute will directly conduct security inspections for member institutions, while service providers that cannot undergo direct inspections will conduct self-inspections utilizing the specialized standards or proceed with inspections through specialized information protection companies.
