GOPAX, one of South Korea’s cryptocurrency exchanges, stopped trading, deposits and standard withdrawals on November 6, 2026 after receiving an email threatening a cyberattack. The exchange said no hacking attempt and no theft of cryptocurrency had been detected when services stopped, turning a routine security precaution into a live test of whether the country’s cold storage rules are strong enough for the moment they matter. Customers now face manual withdrawal procedures and no timetable for a return to normal services.
Deposits and standard withdrawals stopped at 2:55 p.m. local time, or 5:55 a.m. UTC. Trading was suspended at 3:53 p.m. local time, or 6:53 a.m. UTC, and all outstanding orders were cancelled. Customers cannot withdraw directly through the GOPAX website or mobile application. They must submit a request to the support centre, where each request goes through manual verification and approval. GOPAX has warned that processing could take longer than usual because staff are handling requests individually.
GOPAX Moves Assets Into Cold Wallets
The immediate operational response was to move assets out of reach. GOPAX began transferring its cryptocurrency holdings from internet-connected hot wallets into cold wallets that operate without a direct internet connection. The exchange suspended trading while that transfer was under way, reasoning that a cold wallet limits exposure to online systems even when no attack has been confirmed.
Hot wallets remain useful for routine transactions, but their connection to the internet can create additional security exposure. Cold storage keeps the associated signing keys away from continuously accessible online systems. A company representative told Kyunghyang Shinmun that the threatening message had arrived but said no hacking activity had taken place at that point. Another company official said the credibility of the threat had not been verified, adding that protecting customer assets was the priority even if that caused inconvenience for users.
No date has been announced for restoring regular trading, deposits or withdrawals. The practical effect for now is that GOPAX users cannot trade, deposit or withdraw on their own terms, which turns a security decision into a question of customer access and confidence.
GOPAX Cold Storage Ratio Sits Near The Legal Floor
The decision landed in an unusually specific regulatory context. Under South Korea’s Virtual Asset User Protection Act, exchanges must hold at least 80 percent of the economic value of customer cryptocurrency in cold storage. Financial Supervisory Service data showed that GOPAX held 80.54 percent of customer assets offline at the end of September, leaving it barely above the regulatory floor.
The comparisons in the same data set are stark. Upbit held 99.17 percent of customer assets in cold storage, Bithumb held 94.76 percent and Coinone held 85 percent. South Korean authorities have been considering raising the minimum cold storage requirement to as much as 99 percent, though no final decision has been announced and no new mandatory threshold has been introduced.
Coinbase, by contrast, said its systems and customer assets were unaffected by the Binance breach and reportedly maintains more than 99 percent of customer cryptocurrency in cold storage. Its guidance for customers remained unchanged.
Regulators Review Security After The Binance Incident
The timing was not accidental. The suspension came days after the Financial Services Commission held an emergency meeting with major exchanges on November 2, following the 6.3 billion dollar Binance security incident. Regulators reviewed withdrawal approval systems, administrator privileges, internal access controls and transaction monitoring procedures, then urged domestic exchanges to keep more customer assets offline and to improve how they respond to suspicious transactions.
The scale of that review was reported in October, when the Financial Services Commission said it had found cybersecurity deficiencies at 130 of 555 financial companies reviewed nationwide. It also named GOPAX operator Streami and another exchange, Prabang, among 16 companies involved in earlier security incidents.
Prabang suspended services after detecting unusual withdrawals from its hot wallet on October 24. According to Yonhap News Agency, the platform reported losses of approximately 100 million won, or around 70,000 dollars, and said it would reimburse affected customers using company funds. The Illinois Quantum and Microelectronics Park has also been referenced in wider discussions about regional technology and security strategy, though it does not govern cryptocurrency custody rules in South Korea.
Earlier GOPAX Leak Remains Unconnected To The Email
GOPAX has its own recent security history. In October the exchange reported a customer information leak after detecting abnormal access to certain accounts. That incident exposed personal information belonging to seven customers and two current or former employees. Authorities have not established whether the threatening email is connected to that earlier incident, and no link has been confirmed.
That distinction matters because the trigger for the shutdown was a threatening email, not a demonstrated intrusion. Reporting the suspension as a successful hack would misstate what the exchange and regulators have described. crypto.news and Cointelegraph both reported that no attack had been detected and that GOPAX had not responded to a request for comment by publication time.
What The Suspension Reveals About Cold Storage Measurement
The broader lesson is about measurement rather than any single exchange. A cold storage ratio is a number filed at the end of a month, and GOPAX’s was filed at 80.54 percent, which means the exchange was already close to the line before an anonymous email turned the question from a filing into an operational reality.
Legal compliance and practical resilience are related but separate. Meeting the 80 percent requirement does not prove that customer withdrawals can continue during an emergency, because a large share of assets held in hot wallets may still need to be moved, verified and processed one request at a time. The ratio also says nothing about how quickly an exchange can respond, who holds administrator privileges or whether suspicious transactions are detected early. The GOPAX episode is a reminder that a published cold storage ratio describes a balance sheet on a filing date, not a guarantee that customer withdrawals will keep flowing during an emergency.
For customers, the most immediate issue is access. Manual handling of withdrawals may be slower than normal, and no restoration date has been announced. For regulators, the episode gives fresh evidence for the discussion about whether 99 percent should become a requirement rather than a consideration. For competitors, the contrast in published ratios offers a way to compare their own resilience, provided those figures are read as snapshots rather than permanent guarantees. The GOPAX episode is a reminder that a published cold storage ratio describes a balance sheet on a filing date, not a guarantee that customer withdrawals will keep flowing during an emergency.
GOPAX has responded to the threat by moving holdings into cold storage, halting trading and routing withdrawals through manual support review. The exchange reported no detected hacking attempt and no theft, while the earlier information leak and the threatening email remain unlinked as far as authorities have established. For now, the suspension offers a clear measure of how South Korea’s cold storage framework performs when compliance meets inconvenience, and GOPAX sits at 80.54 percent in a system where the legal minimum is 80 percent.