South Korean Crypto Exchange Gopax Apologizes Two Days After Regulator Disclosed ...

South Korean cryptocurrency exchange Gopax has posted a belated apology regarding a customer personal information leak. Roughly a month elapsed between when the breach occurred and when the exchange officially recognized it, and the exchange's own explanation came only two days after the financial regulator first disclosed the incident.

Gopax announced the personal information leak and the scope of the damage in a notice on its website at 4:24 p.m. on the 16th — two days after South Korea's Financial Services Commission revealed the matter on the 14th. According to the notice, abnormal access to some customer accounts began early last month, and the exchange only confirmed the activity earlier this month.

The incident exposed the nicknames and login histories of nine individuals in total — seven customers and two current and former employees — to outside viewing. The company said no cases of unauthorized withdrawal of customers' Korean won or cryptocurrency, or any asset losses, have been confirmed to date.

Gopax said that after detecting the suspicious activity, it implemented account protection measures, blocked the abnormal access route, individually notified affected customers, reported the incident to the financial regulator and the Korea Internet & Security Agency (KISA), launched an investigation into the cause and scope of the breach through an external specialist firm, and added monitoring and security checks.

In the notice, the exchange urged users to "check for suspicious activity such as unsolicited identity verification or account openings, and avoid clicking links in text messages or emails sent by unknown parties." It added, "We sincerely apologize for causing concern," and "We deeply understand our customers' worries and will do our utmost to provide a safer and more trustworthy service."

Personal information protection systems at virtual asset exchanges are subject to heightened oversight by the financial regulator. Under South Korea's Act on Reporting and Using Specified Financial Transaction Information, virtual asset service providers must maintain abnormal transaction detection and Information Security Management System (ISMS) certification, and are obligated to report breaches to the financial regulator and KISA. This incident raises questions the exchange's monitoring system, given the lengthy gap between when the hack occurred and when it was detected.

Gopax has drawn industry attention since last year over management control issues and funding problems. This security incident comes at a time when restoring user trust is urgent, and some observers say it could deal an additional blow. However, the fact that no asset losses have been confirmed limits the scope of the damage.

Industry watchers suggest this incident may prompt stronger security reviews across virtual asset exchanges. Some also point out that the pattern of the financial regulator disclosing the incident first, with the exchange following up with its own explanation afterward, is undesirable from an investor protection standpoint. Calls are growing for institutional improvements to ensure prompt disclosure and user notification when similar incidents occur in the future.