South Korean cryptocurrency exchange GOPAX suspended trading and normal deposit and withdrawal services on November 6 after receiving a hacking threat, while retaining a separate process for customers to request withdrawals through support.

The exchange’s first official notice set the suspension of crypto deposits and website or app withdrawals at 14:55 Korea Standard Time, or 05:55 UTC. A second notice confirmed that trading stopped at 15:53 KST and that all unfilled orders had been canceled.

Related reporting: Former FBI Agent Pleads Guilty to $2.47 Million Crypto Theft

The distinction between an interrupted service and a confirmed theft is important. Yonhap reported on November 6 that GOPAX had received an email from a group claiming to have hacked it, but the exchange had not verified the claim. The company also told the news agency that no actual asset loss had been reported.

Withdrawals move to a manual process

In its notices, GOPAX said it planned to transfer all customer cryptocurrency to cold wallets as a precaution. Cold storage reduces online exposure by keeping the relevant wallet infrastructure offline, but it can also require a different process for approving transfers.

Customers seeking withdrawals were directed to the exchange’s customer-support channel rather than the normal website and app functions. GOPAX said requests would be checked internally, approved and processed sequentially by hand, which could take longer than usual.

The later notice linked to a separate official withdrawal guide. Customers should use that notice to find the current instructions and verified support route, rather than relying on unsolicited messages offering to accelerate a withdrawal. The announcement does not guarantee a particular processing time.

Precautionary action, with key questions open

GOPAX’s written notices described the measures as a response to recent data leaks and hacking incidents at financial companies, citing recommendations from financial authorities. They did not themselves describe the threatening email; that detail came from the exchange’s comments to the press.

Neither of the two notices inspected for this report supplied a timetable for restoring normal services. They also did not identify a confirmed exploit or disclose a quantified loss. Those limits should remain explicit when assessing the incident: a temporary trading halt can create immediate difficulties for customers without establishing that customer assets have been stolen.

For users, the practical issues are access to funds, the status of canceled orders and the timing of any reopening. Further official notices will be needed to establish those details. The November 6 announcements support reporting a precautionary shutdown and a slower withdrawal route, while the underlying hacking claim remains unverified in the cited company comments.

Prepared with AI assistance. The lead image is an AI-generated conceptual illustration, not a photograph of an actual event.