GOPAX Freezes Trading and Withdrawals After Hack Threat Email, Moves Assets to Cold Wallets

South Korean cryptocurrency exchange GOPAX halted deposits, standard withdrawals and trading on Friday after receiving an email threatening a cyberattack, then began sweeping its crypto holdings into offline storage as a precaution.

The exchange, operated by Streami, cut off deposits and ordinary withdrawal service at 2:55 p.m. local time (5:55 a.m. UTC), according to its own notices. Trading stopped at 3:53 p.m. (6:53 a.m. UTC), and every outstanding order on the book was canceled. GOPAX said it had found no sign of an actual intrusion or of funds being taken at the time it shut the services down.

Withdrawals have not been eliminated entirely, but the normal channel is closed. Customers must now file requests through the support center, where each application goes through manual verification and approval before it is processed. GOPAX warned that the hand-checking will slow payouts. It has not given a date for restoring regular service.

The company said the suspension was a preventive step taken while it reviewed security exposure, and that it was moving assets out of internet-connected hot wallets into cold storage. Cold wallets hold the signing keys offline, which removes them from the reach of an attacker who breaches an exchange's online systems; hot wallets remain necessary for day-to-day settlement but carry more exposure.

GOPAX did not respond to a request for .

The shutdown lands days after South Korea's Financial Services Commission urged domestic platforms to raise the of customer assets kept offline. The regulator convened an emergency meeting with major exchanges on Nov. 2 following a $6.3 billion security breach at Binance, and reviewed withdrawal approval systems, administrator privileges, internal access controls and transaction monitoring. It then pressed operators to hold more customer funds in cold storage and to sharpen their response to suspicious transactions.

Under the Virtual Asset User Protection Act, South Korean exchanges must keep at least 80% of the economic value of customer crypto assets in cold storage. Financial Supervisory Service data showed GOPAX held 80.54% offline at the end of September, leaving it only a sliver above the legal floor. Peers ran far higher:

Note: Figures are from Financial Supervisory Service data; the statutory minimum is 80%.

Authorities have discussed lifting the minimum to as much as 99%, though no final decision or new mandatory threshold has been announced.

The threat email is the second security headache for GOPAX in recent weeks. In September, the exchange detected abnormal access to some accounts and disclosed a leak of personal information belonging to seven customers and two current or former employees. Investigators have not established whether the threatening message is connected to that breach.

Regulators have been auditing the sector's defenses more broadly. In October the Financial Services Commission said 130 of 555 financial companies reviewed nationwide had cybersecurity deficiencies, and it identified Streami and the exchange Prabang among 16 firms tied to earlier security incidents, prompting plans for tighter oversight.

Prabang, a smaller domestic venue, suspended services on Oct. 24 after spotting unusual withdrawals from its hot wallet. It reported losses of 100 million won (approximately $73,000) and said it would compensate affected customers from company funds.

The immediate market effect of the GOPAX freeze is limited by the exchange's size, but the episode sharpens a regulatory question for Korean platforms: whether the 80% cold-storage floor is adequate when a single threat email can force a full trading halt. Exchanges that sit close to the minimum, as GOPAX does, have less room to rotate assets offline during a scare without breaching the rule, while those already above 94% can absorb a similar shock with less disruption. Any move toward a 99% requirement would force smaller operators to rebuild their custody arrangements, a cost that could accelerate consolidation among the country's second-tier venues.

For traders, the practical constraint is time. With the website and app withdrawal function disabled, positions cannot be exited and coins cannot be moved until manual approvals clear, leaving customers exposed to price swings they cannot act on. The absence of reported losses so far suggests the threat did not translate into a breach, but the manual queue means the exchange's operational backlog, not the attacker, is now the binding constraint on customer access.