[DiaryPoint | Reporter Eom Ju-yong] South Korea’s Financial Supervisory Service plans to convene chief information security officers (CISOs) from domestic virtual asset service providers on Nov. 19 for a meeting on hacking response. The meeting will include all providers, including exchanges and custodians, and review their security operations, prevention measures and incident response plans.
The meeting comes amid a string of personal data leaks and asset thefts at exchanges in South Korea and abroad. GOPAX reported the exposure of personal information belonging to seven users and two current or former employees. At Bithumb, the names, mobile phone numbers, resident registration numbers and copies of ID documents of 844 customers were exposed. At the coin-market exchange ProBahn, assets worth 100 million won were withdrawn abnormally from a hot wallet.
Overseas exchange Binance said an Oct. 29 incident affected assets worth about $6.3 billion. In its initial investigation, Binance said unauthorized access to an internal wallet-signing service led to transactions outside the normal withdrawal process, while stressing that “user funds are safe.” The company added that it would cover the losses itself.
On Nov. 2, South Korea’s Financial Services Commission convened an emergency review meeting with the Financial Supervisory Service, the Financial Security Institute, the Digital Asset Exchange Alliance and major industry players. Authorities reviewed the share of assets held in cold wallets and the status of insurance and reserves, and called for continuous monitoring of deposits and withdrawals and prompt reporting and sharing of information on suspicious access attempts.
Check login alerts and withdrawal history
Users should review login records in their exchange apps for access times, devices or locations that seem unusual. They should not approve login or authentication alerts they did not initiate. Upbit says it requires two-channel authentication for Korean won deposits and withdrawals and mobile digital asset withdrawals, with an additional verification step for each withdrawal.
Withdrawal records can reveal transactions users did not request or unfamiliar registered addresses. Upbit advises users who have inadvertently approved a QR authentication request to log out of all devices, lock their account and restrict withdrawal addresses. Users should also remove unused devices or sessions in their account security settings and check the web address before opening links that appear to come from an exchange.
The Financial Supervisory Service meeting is scheduled for Nov. 19. Exchanges affected by earlier incidents are working with relevant organizations to investigate what happened and whether there has been further damage, or are carrying out internal security measures.