GOPAX Halts Trading and Withdrawals After Hacking Threat Email
GOPAX suspended trading, deposits and standard withdrawals on Nov. 6 after an email threatened a cyberattack. No hack occurred, but the exchange held just 80.54% offline in September, barely above the 80% legal minimum.
A single email threatening a cyberattack froze South Korean exchange GOPAX on Nov. 6. Trading, deposits and standard withdrawals are suspended, and the exchange says it will move all customer crypto to offline cold wallets.
GOPAX's official notices give the timeline. Deposits and standard withdrawals stopped at 2:55 p.m. local time (5:55 a.m. UTC). Trading followed at 3:53 p.m. (6:53 a.m. UTC), and all outstanding orders were canceled.
No hack had occurred. A GOPAX representative told Kyunghyang Shinmun the exchange received the threatening message, but no hack or attempted theft had taken place at that point. No customer losses have been reported.
The exchange cited financial regulators' recommendations for the cold storage move. Customers can still request withdrawals through the support center, but manual verification and approval may slow processing. GOPAX has not said when normal services will resume and did not respond to requests for comment.
Thin offline buffer
The timing puts GOPAX's custody setup under a spotlight. Financial Supervisory Service data showed it held 80.54% of customer assets offline at the end of September, just above the 80% legal minimum under the Virtual Asset User Protection Act. Peers sit higher:
- Upbit: 99.17%
- Bithumb: 94.76%
- Coinone: 85%
The Financial Services Commission (FSC) held an emergency meeting with major exchanges on Nov. 2, after the Oct. 29 Binance incident, in which about $6.3 billion was stolen. It urged exchanges to keep more assets offline. Authorities are weighing a minimum as high as 99%, with no final decision. Our earlier coverage details how the FBI tied the Binance hack to North Korea's TraderTraitor group.
Ownership and prior incidents
Binance owns roughly 67% of Streami, GOPAX's operator. South Korea's Financial Intelligence Unit recognized the ownership change in October 2025. Binance first took a majority stake in February 2023 through its Industry Recovery Initiative.
GOPAX reported a customer information leak in October affecting seven customers and two current or former employees. Authorities have not established whether the new threat is connected.
It is not the only recent scare. Prabang suspended services after unusual hot-wallet withdrawals on Oct. 24, reporting losses of about 100 million won ($70,000). In October, the FSC named Streami and Prabang among 16 companies involved in earlier security incidents.
What it means
This is a precautionary halt, not a breach. But it lands in a tense week for Korean exchanges. A threat alone was enough to freeze trading at an exchange sitting close to the legal offline minimum. If regulators move toward a 99% floor, GOPAX would have the furthest to go among the exchanges cited.
The resume date is the next thing to watch.
