South Korea calls emergency crypto meeting amid North Korean theft and AI hacking wave

South Korea’s Financial Services Commission (FSC) called in the country’s largest crypto exchanges on Monday to inspect their defenses after about $6.4 billion was drained from Binance.

The FBI has blamed the Binance hack on North Korea. South Korea’s Financial Services Commission has called several similar meetings this year.

Why did the FSC meet with crypto exchanges?

Following the Binance hack that resulted in about $6.4 billion being drained, South Korea’s Financial Services Commission (FSC) brought in working-level staff from five won-based exchanges, including Upbit, Bithumb, Coinone, DigitalX and Gopax, plus coin-market venues such as Foblgate, at 10 a.m. Monday. One or two people attended from each firm.

The meeting came before a planned security check across the whole financial sector set for Wednesday. An FSC official said that the aim of the meeting was to see how ready domestic exchanges are in the wake of the Binance breach.

Under South Korea’s Virtual Asset User Protection Act, crypto exchanges must keep at least 80% of their customers’ deposited digital assets in cold wallets. Upbit reportedly keeps more than 99% of its customers’ deposited crypto in cold wallets. Meanwhile, Bithumb has about 94% of its deposited crypto in cold wallets and Coinone roughly 85%. DigitalX and Gopax operator Streami sit in the low 80s.

Regulators are expected to raise those numbers higher.

The focus on cold wallets is because during the Binance theft, the stolen funds were taken from hot wallets, the online wallets exchanges use for everyday transactions.

Why does the FBI think North Korea hacked Binance?

Binance reportedly lost roughly $6.4 billion, about 8.4 trillion won, from hot wallets the exchange ran across several blockchains on October 29. TRM Labs traced about $6.36 billion leaving across ten chains, most of it within a period of about 20 minutes.

The FBI linked the attack to North Korea on October 31, saying it was carried out by a group it calls TraderTraitor, the same attackers responsible for last year’s $1.5 billion Bybit hack. Exchanges and analytics firms have been asked by the FBI to block the linked addresses and said the thieves were converting the money stolen from Binance into ether.

Notably, President Donald Trump downplayed the FBI’s findings at a Halloween event in Florida, saying “We don’t know if it’s North Korea.”

Binance said it had enough of the same assets set aside to cover 90% of the missing funds and would make customers whole.

Prior to the Binance case, South Korea was already working through a separate run of breaches. Cryptopolitan reported that the police opened a preliminary inquiry into data thefts at Bithumb, Daishin Securities and Mirae Asset Global Investments and they are checking whether they are related to an earlier wave of thefts that hit 16 firms.

ARTEX, a China-built open-source penetration-testing tool that runs alongside AI models such as Claude Code, was reportedly used in the earlier incidents.

Daishin Securities saw data on 38,490 clients exposed. Across the 16 firms, the toll reached roughly 100,000 records as of October 14. The FSC had already screened 555 financial companies and flagged 130 companies for shortcomings like missing patches and no real-time monitoring.

Outsiders reached Bithumb’s Daouoffice mobile groupware and exposed resident registration numbers, account numbers and ID copies for 844 customers. Prabank suffered even further, losing about 100 million won in customer assets and halting service.

Microsoft Threat Intelligence said three North Korean crews, Jade Sleet, Coral Sleet and Jasper Sleet, have built AI into their full operations, its top tier, and named crypto exchanges and financial firms as Pyongyang’s main targets. There is no evidence AI was used in the Binance hack itself.

Why is the rule to protect users still stuck?

Monday’s summons was not the first emergency meeting. In February, FSC Chairman Lee Eog-weon convened officials from the Korea Financial Intelligence Unit and the Financial Supervisory Service after Bithumb mistakenly paid out bitcoin, using the session to push for stronger internal controls and a strict-liability rule for user losses.

That rule still has no legal footing. The Digital Asset Basic Act, the second-phase bill meant to cover issuance, disclosure and user compensation, remains unpassed. At an October 22 parliamentary audit, lawmakers from both parties questioned the delay.

Rep. Min Byungdeok of the Democratic Party noted that the U.S. passed its GENIUS Act in July 2025 and Hong Kong followed in August 2025, while Korea, he said, “did nothing.” Lee answered that the bill was “in the final stages of consultations.”

Regulators have floated a no-fault compensation requirement under the bill, which would hold exchanges liable for losses from hacking and system failures in areas they control.

Until it passes, Korean users caught in a breach have weaker recourse than Binance customers, whom the exchange has pledged to reimburse in full.