South Korea's Financial Services Commission has announced a broad cyber-defense overhaul that will bring virtual-asset service providers into a faster financial-sector reporting system. The regulator said it will prepare November guidelines requiring crypto providers to notify financial authorities immediately when they discover a hacking attack. Under the current framework described by the FSC, those firms are required to report such incidents to the Korea Internet & Security Agency, but not immediately to financial supervisors.

Why the reporting rule is changing

The FSC said rapid reporting is necessary because virtual-asset providers are increasingly connected with the wider financial system. Direct notice to financial authorities is intended to speed investigation, information sharing and consumer-protection measures. The change is part of a joint anti-hacking control system that will let companies distribute threat information across financial sectors through FIRST, a platform operated by the Financial Supervisory Service. A pilot is planned for December, followed by wider adoption in the first quarter of 2027.

Related reporting: Binance and Deribit Revoke SignalPlus API Keys After Alert

Forty incidents triggered a wider review

The policy follows a sharp rise in reported attacks. From September 30 through November 3, the FSC counted 40 hacking cases affecting 37 financial companies. The affected group included four banks, five investment businesses, three insurers, five savings banks, ten electronic-finance providers and three virtual-asset service providers, among other firms. The regulator estimated that about 473,000 items of personal information were exposed, covering employee details and customer names, resident-registration numbers and account numbers. It said no customer account passwords had been reported stolen.

Losses were reported, but not by users

Smaller businesses in the virtual-asset, electronic-finance and online peer-to-peer lending sectors reported combined fund losses of about 1 billion won, according to the FSC. The regulator said the missing money was mostly held in company management accounts and that individual users had not yet been found to have lost funds. That distinction could change as investigations continue, so the current figure should not be treated as a final loss assessment. The FSC and Financial Supervisory Service said existing liability, insurance and reserve rules will guide consumer protection.

APIs and internal controls face inspection

Authorities will inspect external access points and internal controls at about 580 businesses spanning traditional and nontraditional finance. The review covers authentication and access controls, sales and management APIs, web-development and testing systems, executive responsibilities and IT-asset registers. Companies may be instructed to suspend affected services and cut off external connections when vulnerabilities are identified. Checks of external contact points for registered IT assets are scheduled to finish by the end of November, while the internal-control review is due by year-end.

What comes next

The government also plans twice-yearly third-party vulnerability reviews for large financial companies, new support programs for smaller firms and a bill on digital-finance safety in the first quarter of 2027. That legislation would apply cybersecurity requirements comparable to those in the Electronic Financial Transactions Act to virtual-asset providers and other businesses holding sensitive customer information or exposed to customer-fund losses. Smaller firms are also due to receive staged cyber-defense assistance from the Financial Security Institute beginning in December. The immediate reporting guidance is therefore an interim operational step, while the inspection results and future legislation will determine how the longer-term regime is enforced.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.