South Korea plans tougher crypto security after 16 hacks

South Korea has proposed stricter cybersecurity rules for banks, cryptocurrency businesses and other financial companies after confirming security incidents at 16 institutions, approximately 100,000 exposed customer records and weaknesses at 130 of 555 firms reviewed as of October 14.

The Financial Services Commission (FSC) announced the proposals following its second emergency response meeting in Seoul, where officials reviewed the recent attacks and the results of an industrywide security inspection. Planned changes include more frequent vulnerability assessments, improved threat monitoring and clearer responsibility for company executives.

South Korea finds security problems at 130 firms

The FSC completed a review of 555 financial companies using a 12-point cybersecurity checklist by October 8. Of those businesses, 425 reported that their security measures met the checklist requirements, while 130 identified problems requiring correction.

The regulator said most affected companies needed improvements in one or two areas. Common failures included outdated security software, weak monitoring systems and insufficient protection for externally accessible computer systems.

Some companies had not installed the latest security updates. Others continued operating systems that manufacturers no longer supported, leaving them without regular security maintenance.

The inspection found that certain businesses lacked continuous security monitoring. Authorities identified weaknesses in access controls, including cases where important systems did not use enhanced authentication procedures such as multifactor authentication.

Electronic financial service providers and online lending businesses reported a relatively high number of shortcomings. The FSC attributed the pattern partly to the sectors’ more limited cybersecurity resources.

Companies that identified weaknesses submitted plans to correct them. Measures included installing security updates, replacing outdated equipment, expanding monitoring staff and restricting access to sensitive systems.

The regulator said affected firms had begun implementing corrective measures following the review.

Importantly, the 130 companies with security deficiencies were not all identified as hacking victims. The FSC separately confirmed actual security incidents at 16 financial businesses.

Crypto companies named among 16 affected businesses

The investigation identified incidents involving four commercial banks, four savings banks, lending companies, electronic financial service providers, online investment businesses and two cryptocurrency service operators.

Among the affected digital asset businesses were Streami, which operates the Gopax cryptocurrency exchange, and Prabang, identified as a virtual asset service provider in the FSC’s announcement.

The banking institutions included Shinhan Bank, KB Kookmin Bank, Busan Bank and Hana Bank. The savings banks were Yegaram, Welcome, DB and OK.

Other affected businesses included Hyundai Capital, KDB Capital, PFCT, Mouda and the Korea Federation of Community Credit Cooperatives.

The FSC estimated that approximately 100,000 pieces of customer information had been exposed across the confirmed incidents.

Compromised records included names, telephone numbers, email addresses and South Korean resident registration numbers.

However, the commission said investigators had not confirmed the exposure of account passwords or payment card numbers that could directly enable unauthorized transactions.

Following the incidents, regulators instructed affected firms to block IP addresses associated with suspicious activity, apply security patches and suspend vulnerable services when necessary.

Customers whose information had been exposed were to receive notification and guidance on protective measures.

The Financial Supervisory Service and the Financial Security Institute continue examining how attackers entered the affected systems. Investigators are comparing technical evidence across incidents to determine whether the same individuals or groups were responsible.

Authorities have not established whether artificial intelligence played a role in the attacks.

South Korean cryptocurrency businesses have faced separate security investigations before. In July, the Financial Supervisory Service began sanctions proceedings against Dunamu, the operator of Upbit, over an earlier wallet breach.

Theregulatory investigation into Upbit’s November 2025 hack concerned the exchange’s security responsibilities and compliance with existing virtual asset protection laws.

That proceeding concerns a different incident and has not been linked by the FSC to the latest group of financial sector attacks.

South Korea proposes twice-yearly cybersecurity checks

Following the inspection results, the FSC outlined plans to increase the frequency of cybersecurity assessments, beginning with large financial institutions.

Current financial regulations generally require vulnerability evaluations once per year, with twice-yearly checks already applying to external websites.

The proposed reforms would extend assessments to at least twice annually for larger institutions with extensive external connections and customer bases.

Regulators intend to make important external access points mandatory inspection targets. Authorities are considering additional security examinations outside scheduled reviews when urgent threats emerge.

The commission plans a more detailed review of financial institutions’ systems, covering external connections, authentication procedures and internal controls.

Under the proposed arrangements, firms would need clearer records of how external systems connect to their networks and which employees or services can access sensitive information.

The FSC wants responsibilities divided more clearly among chief executive officers, chief information security officers and chief information officers.

Regulators are reviewing ways to strengthen accountability when businesses fail to implement required security measures or disregard recommendations following inspections.

The commission did not announce a final implementation date for the proposed twice-yearly assessment requirements.

Details of the inspection schedule and the institutions covered will be settled through further consultations with financial industry representatives.

Financial regulator plans new AI security tools

Beyond mandatory inspections, the FSC plans to improve how financial institutions report suspected cyberattacks.

Currently, the Financial Supervisory Service and Financial Security Institute distribute threat information to companies through an integrated monitoring platform known as FIRST.

However, information identified by individual financial institutions through their own monitoring systems is not consistently shared across the industry.

The regulator wants to expand the system so firms can report newly identified threats and help other businesses respond before similar attacks spread.

Authorities are preparing an AI-based threat monitoring framework that would classify the severity of detected risks and provide information to financial institutions.

The FSC is considering AI tools capable of testing externally exposed computer systems, internal software code and mobile applications for vulnerabilities.

Smaller companies could receive support through a shared AI-based monitoring service developed with financial industry associations.

The Financial Security Institute will examine the proposed service and prepare security guidance tailored to businesses with limited technical resources.

At the October 14 meeting, FSC Secretary General Shin Jin-chang criticized financial companies that had failed to follow basic cybersecurity requirements despite repeated warnings.

He said it was “very painful” to discover shortcomings after previous financial security incidents had prompted calls for stronger controls.

Shin called for improvements covering external connections, authentication procedures, monitoring systems and executive responsibility.

He said the regulator would pursue a system intended to “defend against AI attacks with AI.”

Authorities had already warned customers about scams

Before announcing the latest proposals, South Korean regulators issued a consumer alert concerning possible misuse of information stolen during financial sector breaches.

On October 6, the FSC and Financial Supervisory Service issued a Level I caution notice warning customers about phishing attacks and fraudulent loan applications.

The agencies established a one-month special response period beginning October 6.

During that period, financial companies were instructed to provide assistance to affected customers and strengthen monitoring of suspicious account openings, loan applications and large transfers.

Authorities directed firms to use the AI-based anti-phishing Sharing and Analysis Platform, known as ASAP, to distribute information about suspected fraud.

The regulator said companies should request additional identity verification where suspicious activity involved potentially stolen customer information.

At the time of the October 6 notice, authorities had not confirmed financial losses caused by phishing or unauthorized transfers using information exposed in the recent breaches.

The agencies said they would raise the consumer alert from Level I to Level II if subsequent financial damage involving stolen information was confirmed.