South Korea’s big experiment in centralized crypto oversight has hit a wall just as regulators are preparing some of their toughest rules yet for digital asset platforms.
The country’s Virtual Assets Committee (VAC), launched a year ago to help steer crypto policy, hasn’t held a single meeting since May. Its sudden silence follows the impeachment of President Yoon Suk-yeol and the arrival of his successor, Lee Jae-myung, who appears to be taking a different approach to crypto regulation.
Instead of relying on the VAC, Lee’s administration is now pushing closer coordination between lawmakers and the Financial Services Commission (FSC), effectively sidelining the committee. At the same time, local outlet Kookmin Ilbo reports that the government’s economic focus has shifted toward boosting the stock market rather than advancing crypto deregulation.
One casualty of this change in direction is the earlier roadmap that aimed to let stock market–listed companies buy crypto by 2025. With the VAC inactive and priorities shifting, that plan increasingly looks unlikely to materialize on schedule.
Strict Liability: Exchanges on the Hook for Hacks
While the VAC has gone quiet, regulators are moving ahead with a powerful new tool: strict liability rules for cryptocurrency exchanges.
The push comes in response to a major hacking incident at Upbit, South Korea’s largest digital asset trading platform. After the breach, the FSC confirmed that it will embed strict liability provisions into upcoming virtual asset legislation designed to strengthen investor protection.
Under the strict liability principle, companies must compensate users for losses from hacks or system failures without users needing to prove negligence or fault. This model is already used in South Korea for high-risk areas such as car accidents and hazardous industrial activities.
Applied to crypto, it means exchanges would be required to reimburse customers for losses linked to security incidents or technical breakdowns, unless the user acted with gross negligence. In other words, the burden shifts firmly onto platforms to keep systems secure and resilient.
Closing a Regulatory Gap
Right now, cryptocurrency platforms sit outside the scope of the Electronic Financial Transactions Act, which governs traditional financial institutions in South Korea. That gap has left investors with limited legal protection when things go wrong.
The Upbit hack highlighted how serious that gap can be. Regulators say the attack took place on November 27 between 4:42 and 5:36 KST a 54-minute window during which large amounts of Solana-based tokens were siphoned off to external wallets.
Data collected by authorities shows this isn’t an isolated issue. From 2023 through September 2025, five major exchanges reported 20 cyber incidents affecting more than 900 users:
- Upbit: 6 incidents affecting 616 users
- Bithumb: 4 incidents affecting 326 users
- Coinone: 3 incidents affecting 47 users
Despite the scale of these problems, regulators found they had no clear legal basis to directly sanction exchanges under the current Virtual Asset User Protection Act.
Lee Chan-jin, governor of the Financial Supervisory Service (FSS), called system security “the lifeblood of virtual asset markets,” underscoring why the government is now moving to harden the rules.
New Requirements and Tougher Penalties
The new legislation aims to put crypto platforms on the same footing as banks and other financial institutions when it comes to security and operational standards. Under the draft framework, exchanges would be required to:
- Maintain sufficient qualified staff and dedicated security teams
- Invest in robust IT systems, infrastructure, and monitoring tools
- File annual technology and security plans with regulators
On top of that, penalties are set to rise sharply. Fines could reach up to 3% of a company’s annual turnover, a level designed to make cybersecurity and compliance a board-level priority rather than a secondary concern.
Industry watchers expect the new rules to move quickly through the legislative process, with the ruling party signaling strong support for measures that protect retail investors. Exchanges, for their part, are already preparing to tighten compliance, upgrade systems, and rethink their risk management strategies.
South Korea’s VAC may have gone quiet, but the broader message from regulators is loud and clear: if you operate a crypto exchange in the country, you’ll soon be on the hook for keeping user funds safe and there will be real financial consequences if you fail.
