South Korea’s CBDC pilot skipped independent security audit

The pilot program for the central bank digital currency (CBDC) in South Korea seems to have gone through live blockchain payments with thousands of users without even a single independent security audit, raising new doubts as central banks around the world speed up their plans to implement digital currency systems.

The Project Hangang by the Bank of Korea (BOK) is one of the most famous CBDC experiments worldwide, and its security practices have gained much interest outside of Korea. However, even though the pilot project tested the technologies in practice, it was mainly the banks directly involved in the experiment who verified the systems, and not any external organization.

What the pilot actually verified

Documents submitted by the Financial Supervisory Service (FSS) to Representative Lee Hun-seung’s office on July 20 show that regulators did not conduct an independent security inspection during the first phase of Project Hangang. The first pilot ran from April to June 2025.

The only formal evaluation took place prior to the launch. In February 2025, the banks involved conducted initial security tests and self- evaluations of their technology vulnerabilities. The evaluations were done by the internal audit teams at Woori Bank and NH Nonghyup Bank with help from the Financial Security Institute and SK Shields, according to the report.

However, there was no outside audit conducted after the pilot had been launched.

Later on, doubts arose regarding the security risks of the deposit-token system after its launch in the market. The BOK indicated in Note 10 of the pilot report that they had conducted thorough assessments of the system before its launch, so further inspections were not required. Maeil Business Newspaper emphasized that essentially the operator was left to evaluate the safety of its own operation.

A thin supervisory backbone

The Financial Supervisory Service and banking sector had only one formal discussion on CBDC and deposit tokens in the last three years, which was focused on a Shinhan Bank insurance product that is connected to the deposit token. Apart from this, the banking industry has no dedicated supervisory body for monitoring CBDC.

The BOK has justified its actions by stating that the security checks before the launch were adequate and followed the supervisory guidelines agreed upon with the FSS.

Experts in the industry claimed that the security evaluations have a wider scope than just spotting the flaws in technology.

An industry official said to the Maeil Business Newspaper that “the actual transaction pilot is a process of securing public trust as well as technology verification.” The source continued that providing objective monitoring is problematic when the same organization creates, tests, and clarifies the safety of the system. Thus, it is important to conduct external security validation and audits for instilling confidence in the market, the official concluded.

The above point of view reflects wider thinking of central banks. In 2022, researchers of the US Federal Reserve, Tarik Hansen and Katya Delak, considered the issue of security as one of the major design parameters of CBDC. They stressed the importance of reliable and independent verification during national digital currency evaluations.

Why the timing raises the stakes

The controversy arises as South Korea begins preparations to broaden the scope of the project.

Phase 1 was already conducted at a large scale. Seven banks had executed 114,880 transactions through approximately 81,000 digital wallets and nearly 12,000 merchants. However, only 42% of digital wallet owners managed to complete the payment, Decrypt states. The banks involved reportedly invested 30 to 35 billion won in creating the infrastructure.

Phase 2 will be much bigger.

The Financial Services Commission approved the next phase of the project on July 15. This approval added Gyeongnam Bank and iM Bank to the program, bringing the total number of banks involved to nine. The wallet cap will be raised from 100,000 members to 500,000 members. Individual wallet limits will also be increased from 1 million won to 10 million won. New technological features that will be added will include person-to-person transfers, biometric authentication, automatic top-ups, and programmable government subsidy payments.

Project Hangang reveals a hybrid approach that is garnering international interest. Instead of issuing retail CBDCs directly to the public, the project envisions commercial banks issuing deposit tokens on the blockchain that are backed by wholesale CBDCs used between financial institutions.

Kim Dong-seop, who leads the Digital Currency Planning Team of the BOK, describes the framework as “a middle ground between a CBDC and a stablecoin.”

The hybrid model is one that many central banks are starting to consider. With South Korea getting closer to launching programmable government payments to some 500,000 users, the lack of independent verification of the production security is no longer just an issue at home. The verification processes used in Project Hangang may shape how various countries monitor CBDC activities as their own CBDC programs move from controlled pilots to everyday use.