South Korea Pushes New Plans for Strict Crypto-Exchange Liability After Upbit Hack
In response to a massive hack at Upbit, South Korea now plans to overhaul the legal duties of crypto platforms, requiring them to reimburse customers for losses even if no negligence can be proven.
On the night of November 27, 2025 — between 4:42 a.m. and 5:36 a.m. KST — the Upbit breach saw some 24 types of Solana-based assets, totalling roughly 104,064,700,000 coins (worth about 44.5 billion won), siphoned off to external wallets at breakneck speed. Over a 54-minute window, approximately 32 million coins changed hands each second. Despite the severity and scale of the theft, current laws offered regulators no clear route to hold exchanges legally accountable.
Under the proposed framework, exchanges — which previously operated outside the scope of the Electronic Financial Transactions Act — would be bound to strict “no-fault liability.” That means victims of hacks or system malfunctions get swift, predictable payouts without needing to prove any wrongdoing. The only exception: if users themselves acted with gross negligence.
The change comes after alarming disclosures. Between 2023 and September 2025, five major exchanges disclosed 20 separate IT-related failures, cumulatively affecting over 900 users and resulting in more than $29 million in damages. Upbit alone accounted for six incidents and 616 affected users; Bithumb and Coinone logged multiple incidents too.
Under the draft legislation, crypto exchanges will be subjected to the same stringent operational standards as banks — from staffing and infrastructure to annual technology and security audits submitted for regulator review. Financial penalties will also become more severe: where fines once topped out around $3.5 million, the new rules could impose fines up to 3 % of a platform’s annual revenue.
Lawmakers and regulators, including Financial Services Commission (FSC) and Financial Supervisory Service (FSS), have signalled they intend to pass the reforms swiftly. For cryptocurrency users in South Korea, those reforms may soon offer far stronger protections.