GOPAX hits the panic button: South Korean crypto trading halts as hackers claim breach

GOPAX, a South Korean cryptocurrency exchange, responded to a claimed hacking threat by restricting activity. It stopped withdrawals at 2:55 p.m., suspended trading around 3:53 p.m., and temporarily blocked deposits and regular website and app withdrawals. The exchange said it had not confirmed whether the threat was genuine.

The main reason was asset protection. GOPAX began moving most assets from hot wallets into cold wallets, which are not connected to the internet. It also cancelled every outstanding order after trading stopped. These steps can limit exposure while staff assess a possible attack.

The disruption affected normal customer access but was precautionary. GOPAX said no actual asset loss had been reported. Its official said the company was prioritising customer protection, even though the measures would inconvenience users. The exchange had not announced when services would fully resume.

A hot wallet is a cryptocurrency wallet connected to the internet. Exchanges use hot wallets to support routine deposits, withdrawals, and transfers. A cold wallet is kept offline or disconnected from the internet. It is less convenient for frequent transactions, but it can reduce direct exposure to remote hacking attempts.

GOPAX said it was moving most assets from hot wallets into cold wallets after receiving a hacking threat. The mechanism is straightforward: fewer assets remain in an internet-connected system while the exchange checks whether a threat is real. The company also stopped withdrawals and deposits, limiting movement during the review.

Cold storage is a security measure, not proof that an exchange has been attacked or that funds are completely risk-free. GOPAX said it had not verified the threat and reported no actual asset loss. The article does not describe the exchange’s broader wallet controls or recovery process.

South Korea’s Financial Services Commission confirmed cybersecurity incidents at 37 financial institutions. Those incidents affected about 470,000 customer records. The figures provide the article’s clearest measure of the wider security problem facing the country’s financial sector.

This scale matters because a cybersecurity incident can reach many organisations and expose information linked to large numbers of customers. The article does not say that all 470,000 records belonged to cryptocurrency users, nor does it connect those records directly to GOPAX’s threat. It presents them as broader sector context.

GOPAX’s emergency restrictions therefore occurred during a period of repeated cybersecurity incidents. The exchange said it was acting before confirming whether its threat was genuine. The article gives no further breakdown of the 37 institutions, the affected records, or the final outcomes of those incidents.

When an exchange suspends withdrawals and deposits, customers cannot move digital assets into or out of their exchange accounts through the affected services. When trading is suspended, they cannot buy or sell through that platform. These restrictions can interrupt planned transactions and leave assets inaccessible until operations resume.

At GOPAX, the exchange halted withdrawals, temporarily suspended virtual-asset deposits, and disabled regular withdrawals on its website and mobile app. It also stopped trading and cancelled all outstanding orders. That means pending trades were not left active while the exchange investigated the threat.

The article does not state how long the restrictions would last or whether customers would receive compensation. It says the measures were precautionary and intended to protect assets. GOPAX reported no actual loss, but customers still faced inconvenience and uncertainty while the exchange assessed the credibility of the hacking claim.

GOPAX said it received an email from a group claiming to have hacked the exchange. The group’s identity was not provided in the article. No named attacker, technical evidence, or confirmed breach was reported.

Saying the threat was not verified means GOPAX had not yet determined whether the email described a real intrusion. The claim could not be treated as confirmed simply because it was received. The exchange therefore acted defensively while checking the threat’s credibility, rather than waiting for proof before protecting assets.

GOPAX moved most hot-wallet assets into cold wallets and suspended deposits, withdrawals, and trading. These actions were designed to limit possible exposure and protect customers during the review. The company said no actual loss of assets had been reported. The article does not say whether investigators later confirmed or rejected the group’s claim.

In general, a cryptocurrency exchange pools digital assets in wallets it controls on behalf of customers. It also maintains internal account records showing each customer’s balance. A blockchain records transfers between wallet addresses, but an exchange may settle many customer trades internally without moving coins on-chain each time.

For an on-chain withdrawal, the exchange uses the wallet’s private key to authorise a transaction. It broadcasts that transaction to the relevant blockchain, which verifies and records it. Moving funds between hot and cold wallets similarly involves transferring assets between addresses controlled by the exchange, though the article does not describe the technical steps.

GOPAX said it was moving most assets from hot wallets into cold wallets and stopping customer movements. That suggests a temporary shift away from internet-connected storage. The article does not explain its custody design, blockchain networks, private-key controls, or how customer balances would be reconciled after services resumed.

During a security suspension, customers can first monitor official exchange updates and avoid sharing passwords, codes, or personal information with people claiming to offer help. They should keep records of balances, deposits, withdrawals, and cancelled orders. The article does not identify any customer workaround or alternative service.

If access is restored, customers can follow the exchange’s stated security and withdrawal procedures. In general, a customer who uses another exchange should independently assess that platform’s reliability and security before transferring funds. Moving assets elsewhere may not be possible while withdrawals are disabled, and rushing can create additional risks.

At GOPAX, deposits and withdrawals were suspended, trading stopped, and outstanding orders were cancelled. The company said it was prioritising asset protection while checking the threat. Customers therefore faced waiting rather than a specific solution announced in the article. It did not provide a reopening time, compensation plan, or recommended alternative.