South Korea Proposes Withdrawal Suspension for Cryptocurrency: What Happens When Exchanges Suspect a Hack

Key Points Summary: On November 12, 2026, South Korea's Financial Services Commission (FSC) announced plans to issue a no-action letter allowing domestic cryptocurrency operators to suspend deposits and withdrawals in advance, even before confirming a breach, if there is suspicion of a hack or intrusion. The complete conditions and issuance date of the letter were not disclosed in the announcement. This is a policy move in South Korea and does not constitute global rules or evidence that specific exchanges are under attack. The initial operational pivot for users is whether there is an on-chain transaction ID for withdrawals. Requests before broadcasting are under the platform's control, but submitted transactions must also be verified on the blockchain.

What Did South Korea's Regulatory Authorities Announce on November 12?

The FSC's Korean press release summarizes a meeting held on November 12 with supervisory authorities, security-related agencies, and domestic cryptocurrency operators. The content covers three areas: emergency security guidance for operators, plans for a no-action policy regarding pre-suspension of deposits and withdrawals in case of suspected hacks, and broader security support or inspections through the Financial Security Research Institute. This announcement pertains to the overall management of the sector following recent incidents, and there were no reports of specific exchanges being hacked during the meeting.

Legal issues are limited. The FSC explains that under the current South Korean User Protection Act, unjustified suspensions of deposits and withdrawals are restricted, while clearly occurring hacks could serve as grounds for suspension. The industry pointed out uncertainties regarding the stage where investigators have not yet confirmed abnormal activities suggesting an intrusion. The regulatory authorities decided to issue a no-action letter for preventive measures in such situations. The no-action policy is meant to address supervisory risks under the stated conditions and should not be interpreted as completing legal amendments or granting rights to indefinitely freeze customer funds.

The release does not include the text of the letter itself. The final criteria for suspicion, allowable suspension periods, notification templates, and release procedures are also not defined. These details are crucial for users. Articles that convert the meeting announcement into fixed timeframes or universal suspension criteria would add facts not included in the sources. Please check subsequent official documents before the next update of this article.

Jurisdiction is equally important. The FSC supervises the South Korean market and operators within its authority. Users utilizing exchanges in other regions should review the terms of use of those exchanges, local laws, and incident notifications. South Korea's proposal may help understand the trade-offs in exchange security overall, but it does not automatically change the withdrawal rights of Phemex or other international platforms.

Why Do CEXs Suspend Deposits as Well as Withdrawals?

In cases of suspected wallet breaches, suspending withdrawals may prevent further outflows while operators verify whether keys, transaction signing systems, and access controls have been compromised. Suspending deposits may seem less straightforward, but exchanges may need to isolate wallet infrastructure to prevent deposits to compromised addresses from being credited to accounts or to avoid accepting funds while verification and account crediting are uncertain. These are potential operational reasons and do not imply that specific incidents followed this pattern.

Exchanges process off-chain account requests and on-chain transfers sequentially. Customers may apply for withdrawals, and operators may verify authentication, balances, risk rules, and address controls, with the wallet system signing and broadcasting transactions, which are then confirmed by the network. A platform's suspension can halt this entire flow before broadcasting. Once a transaction is broadcast, the exchange cannot simply erase it from Bitcoin or Ethereum. They may continue to investigate, warn counterparties, and take other measures, but the on-chain state must be evaluated separately.

There is a similar distinction for deposit transfers. Even if tokens have reached the exchange's management address on the blockchain, the exchange may have temporarily halted internal accounting. Confirmation on-chain does not necessarily reflect that the available account balance has been updated. Users should save both the deposit transaction hash and the exchange's account records. Deposits to unsupported networks or incorrect addresses are separate issues and should not be labeled as security suspensions without evidence.

Therefore, a blanket headline stating "withdrawals have been frozen" is insufficient. The actual actions customers can take depend on the affected assets, networks, account functionalities, and start times. Exchanges can stop individual controls for single chains, all on-chain transfers, internal transfers, and transactions. The FSC's announcement does not specify the scope of specific exchanges, which should be indicated in each operator's incident communication.

What Operational Controls Did the FSC Consider?

The FSC called for monitoring and responses suitable for a market that operates 24/7. According to the release, operators should have personnel and systems capable of identifying unusual large transactions and responding swiftly. Furthermore, operators unable to conduct continuous monitoring should only process deposits and withdrawals during operational hours, notify users in advance, and ensure adequate staffing to handle requests during those hours. This is a proposed operational approach and does not indicate that all South Korean operators are currently limiting their hours.

The release also touches on reducing exposure in hot wallets, considering diversification across multiple hot wallets, and increasing insurance limits and reserves to support compensation if users incur losses. It references the existing 80% requirement for cold wallet storage within South Korea's supervisory framework and states that the overall cold wallet ratio in the industry exceeds 95%. These figures represent South Korea's framework and the industry aggregates cited by the FSC, not Phemex's storage ratio or security metrics for a single exchange.

Cold storage can reduce the amount reachable through online wallet attacks, but it does not completely protect operators from breaches. Key access, transaction approvals, software dependencies, insider controls, and recovery procedures remain critical. Concentrating all assets offline can also impact liquidity. Exchanges need a managed method to replenish hot wallets for legitimate withdrawals. Therefore, security policies must establish limits on exposure and transfer approvals. The discussions regarding the FSC's monitoring, insurance, and reserves recognize that prevention and loss response are distinct challenges.

The FSC also discussed incident reporting and external security reviews. The press release indicates that the government intends to strengthen obligations through future digital asset laws and is seeking timely responses from operators even before the bill is passed. Readers should consider three categories separately: existing laws, guidance or supervisory plans announced on November 12, and provisions anticipated in future legislation. Confusing these could lead to misunderstandings about what is legally valid as of today.

How Can Users Distinguish Between Platform Holds and Network Delays?

First, check the exchange's withdrawal records and look for the transaction hash, commonly referred to as TXID. If the request is pending, under security review, or blocked and there is no TXID, the transaction may not have been broadcast yet. Blockchain explorers cannot verify events that have not been sent to the network. Relevant evidence includes the exchange's status page, responses from verified support, and official incident notifications.

If a TXID exists, verify it on the correct network explorer. Check the destination address, asset, amount, block status, and confirmation count. Pending transactions on the network may be due to fees, congestion, or validator processing and do not necessarily indicate a complete suspension across the exchange. If a transaction is confirmed on-chain but there is no balance on the receiving platform, it may indicate issues with the receiving side's accounting rules or network compatibility. Assets with the same ticker may exist across multiple networks, and viewing the wrong explorer may make it seem like no valid transfer has been found.

Phemex's withdrawal FAQ explains where users can check status information and TXIDs and when to contact support. These procedures are specific to Phemex. The link here is provided because operational distinctions are useful for Phemex account holders, and South Korea's proposal will change Phemex's processes. CTA: Check withdrawal status and TXID. Use verified apps or official sites, not links sent from unknown accounts.

If the platform posts a security notification, record the notification time, affected networks, and promised update channels. Do not assume that user assets have been lost if there is a suspension, nor should you assume that all assets are safe. Both conclusions require evidence. If the exchange offers claims or redemption processes, verify them on the official site. Scammers may exploit incident reports to send fake "unlock" or "recovery" notices asking for seed phrases or payments. Legitimate exchange support should never require users to disclose their private keys.

How Should Users Respond Before and After Suspicious Incidents?

Before an incident, protect your account: use strong authentication, review connected apps, and maintain withdrawal address control if provided by the exchange. These measures reduce account-level breach risks but may not prevent exchange-level failures. Phemex lists available options in the Account Security Guide. Activating or resetting some controls may trigger temporary withdrawal restrictions due to exchange rules, so make changes before urgent transfers are needed.

During a suspension, save records instead of repeatedly submitting transfer requests. Keep order IDs, screenshots showing time and network status, transaction hashes if available, and official notifications. Contact support through verified channels, provide the identification information requested by the exchange, and do not share passwords, recovery phrases, or one-time codes with others. If the issue relates to deposit transfers, include the sending TXID and receiving network. For withdrawal-related issues, confirm whether the request is still under internal processing or has already been broadcast.

For companies holding operating funds on exchanges, withdrawal suspensions also pose liquidity issues. Companies should understand which parts of their equity depend on a single operator, what assets can be moved through alternative approved channels, and whether emergency responses can be managed internally. Diversification can reduce concentration risk but increases counterparty management and reconciliation tasks. The FSC's announcement does not set optimal allocations; each company must assess its own settlement needs and risk tolerance.

The movement on November 12 is most useful as a framework for reading exchange notifications. Preventive holds can serve as protective responses to reliable signals, but excessive or insufficiently explained holds can harm customers. Disclosures should clarify the affected services, why the suspension is necessary without worsening security, and when the next update is expected. Users should evaluate exchanges based not only on whether a suspension occurred but on evidence of detection, communication, and resolution.

Frequently Asked Questions

Did South Korea Freeze Withdrawals for All Cryptocurrency Exchanges?

No. The FSC announced a no-action policy for conditional preventive suspensions in cases of suspected intrusions. It did not order all exchanges to stop withdrawals.

Do Pending Withdrawals Prove the Exchange Was Hacked?

No. Pending requests may be due to authentication, risk assessments, wallet processing, or network conditions. Check official status and the presence of TXIDs.

Can Exchanges Cancel Bitcoin Transactions After Obtaining TXIDs?

Exchanges can stop requests before broadcasting. Once a Bitcoin transaction is broadcast and confirmed, operators cannot simply cancel that on-chain transfer. Subsequent recoveries depend on the facts and parties controlling the destination.

Does South Korea's Proposal Apply to My Phemex Account?

The FSC's release pertains to cryptocurrency operators within its jurisdiction in South Korea. Phemex users should follow Phemex's own withdrawal notifications, help procedures, and applicable account conditions.