South Korea Launches Expanded Bug Bounty Program for Financial Sector

Severity: Low (Score: 27.9)

Sources: Mk.Co.Kr, En.Bloomingbit

Published: 2026-05-18 · Updated: 2026-05-19

Keywords: financial, companies, south, korea, bounty, program, insurance

Severity indicators: bug, financial

Summary

On May 18, 2026, South Korea's Financial Supervisory Service announced the expansion of its bug bounty program, now including virtual asset service providers and corporate insurance agencies. The program aims to enhance the cybersecurity posture of financial institutions by incentivizing white-hat hackers to identify vulnerabilities in digital financial services, including websites and mobile applications. The number of companies eligible for vulnerability checks increased from 32 to 70, covering a total of 306 services. Participants can earn rewards up to 10 million won for each reported vulnerability, with evaluations conducted by the Financial Security Service. This initiative is part of a broader strategy to proactively address cyber threats in an evolving digital landscape. Officials emphasized the importance of collective intelligence from white-hat hackers to bolster security measures in the financial sector. Key Points: • South Korea's bug bounty program now includes crypto firms and insurance agencies. • Participants can earn rewards up to 10 million won for reporting vulnerabilities. • The number of companies under the program has increased from 32 to 70.

Detailed Analysis

**Impact** The expanded bug bounty program affects 70 financial companies in South Korea, including banks, securities firms, insurance companies, virtual asset service providers, and corporate insurance agencies (GAs). A total of 306 digital financial services such as websites, mobile apps, and trading systems are covered. The program aims to reduce the risk of cyber threats targeting the financial sector, which is increasingly adopting AI, cloud technologies, and open-source software. The geographic scope is limited to South Korea’s financial industry. **Technical Details** No specific attack vectors, TTPs, malware, CVEs, or infrastructure details are provided in the articles. The program focuses on identifying unknown security vulnerabilities in digital financial services through external white-hat hackers reporting them for evaluation and reward. The kill chain stage targeted is primarily vulnerability discovery and reporting before exploitation. **Recommended Response** Financial institutions should participate in the bug bounty program by registering with the Financial Security Agency’s platform and promptly addressing reported vulnerabilities. Security teams should monitor for vulnerability disclosures related to the 306 covered services and apply recommended patches or mitigations. Organizations should also strengthen preemptive risk management and update security configurations in line with findings from white-hat reports. Defenders should maintain vigilance for emerging threats as the sector integrates new technologies like AI and cloud services.

Source articles (2)

• South Korea Expands Financial Bug Bounty Program to Crypto Firms, Insurance Agencies — En.Bloomingbit · 2026-05-18
  South Korea’s Financial Supervisory Service will expand this year’s financial-sector bug bounty program to include virtual asset service providers and corporate insurance agencies, among others. The F…
• If Whitehacker discovers and reports security vulnerabilities in financial companies' digital financ.. — Mk.Co.Kr · 2026-05-18
  If Whitehacker discovers and reports security vulnerabilities in financial companies' digital financial services, it can receive a reward of up to 10 million won. Not only banks, securities companies,…

Timeline

• 2026-05-18 — Bug bounty program expansion announced: The Financial Supervisory Service revealed the inclusion of virtual asset service providers and corporate insurance agencies in the bug bounty program.
• 2026-05-18 — Number of companies increased: The program expanded the number of companies eligible for vulnerability checks from 32 to 70, covering 306 services.
• 2026-05-18 — Rewards for vulnerability reporting detailed: Participants can receive up to 10 million won for each reported vulnerability after evaluation.

Related entities

• South Korea (Country)
• Financial (Industry)