Quick Answer: On 12 November 2026, South Korea's Financial Services Commission said it would issue a no-action letter so domestic virtual-asset businesses can preemptively block deposits and withdrawals when a hack or intrusion is suspected, subject to conditions, before a breach is confirmed. The letter's full conditions and issuance date were not given in the announcement. This is a Korean policy step, not a worldwide rule and not proof that any particular exchange is under attack. For users, the first operational distinction is whether a withdrawal has an on-chain transaction ID: an unbroadcast request is still under platform control, while a broadcast transaction must also be checked on its blockchain.
What did Korea's regulator announce on November 12?
The FSC's Korean-language press release summarizes a meeting with supervisors, security bodies and local virtual-asset businesses on 12 November. It sets out three areas: emergency security guidance for operators, a planned no-action position on preemptive deposit and withdrawal blocks when hacking is suspected, and wider security support or inspections through the Financial Security Institute. The announcement is about sector controls following recent incidents. It does not report that a specific venue was hacked during the meeting.
The legal point is narrow. The FSC says current Korean user-protection law restricts deposit or withdrawal blocks without a justifiable reason, while a clearly occurring hack can support a block. The industry raised uncertainty about the earlier stage, when abnormal activity suggests intrusion but investigators have not confirmed it. The regulator decided to issue a no-action letter for preventive action in that situation. A no-action position would address the risk of supervisory action under the stated conditions; it should not be described as a completed amendment to legislation or an unlimited right to freeze customer funds.
The release does not publish the letter itself. It does not define the final threshold for suspicion, the permitted duration of a block, the notice template or the release procedure. Those details matter to users. Any article that turns the meeting announcement into a fixed number of hours or a universal suspension standard would be adding facts the source does not contain. Subsequent formal text should be checked before a later update to this article.
The jurisdiction matters just as much. The FSC supervises the Korean market and the operators within its remit. A user on an exchange elsewhere should look to that venue's terms, local law and incident notices. The Korean proposal can illuminate a general exchange-security tradeoff without automatically changing withdrawal rights on Phemex or another international platform.
Why might a CEX stop deposits as well as withdrawals?
During a suspected wallet compromise, stopping withdrawals can prevent new outflows while the venue determines whether keys, transaction-signing systems or access controls have been affected. Stopping deposits may seem less obvious, but an exchange may need to isolate wallet infrastructure, prevent incoming assets from being credited to a compromised address, or avoid accepting funds while reconciliation and account crediting are uncertain. Those are possible operational reasons, not a claim that any particular incident has followed that pattern.
Exchanges process an off-chain account request and an on-chain transfer in sequence. A customer submits a withdrawal; the venue may check authentication, balances, risk rules and address controls; a wallet system signs and broadcasts the transaction; then the network confirms it. A platform suspension can stop the sequence before broadcast. Once a transaction has been broadcast, a venue cannot simply erase it from Bitcoin or Ethereum. It may still investigate, alert counterparties or take other measures, but the on-chain state must be assessed separately.
Incoming transfers have a similar split. A blockchain can show that tokens reached an exchange-controlled address while the exchange has paused internal crediting. A chain confirmation alone does not prove that the venue has posted a usable account balance. Users should preserve both the deposit transaction hash and the exchange's account record. A deposit to an unsupported network or wrong address is a different problem and should not be labeled a security halt without evidence.
This is why a blanket headline such as “withdrawals are frozen” is insufficient. The affected assets, networks, account functions and start time determine what a customer can actually do. An exchange could pause a single chain, all on-chain transfers, internal transfers or trading as separate controls. The FSC announcement does not specify the scope for a particular venue; that would come from each operator's incident communication.
What operating controls did the FSC discuss?
The FSC called for monitoring and response appropriate to a market that trades around the clock. The release says operators should have personnel and systems able to identify abnormal large transactions and act promptly. It adds that a business unable to run continuous monitoring should process deposits and withdrawals only during hours when the control system is operating, tell users in advance and staff those hours sufficiently to handle requests. This is a proposed operational approach, not a statement that every Korean venue currently limits hours.
The release also discusses reducing exposure in hot wallets, considering distribution across multiple hot wallets, and increasing insurance limits and reserves to support compensation if users suffer loss. It notes an existing 80% cold-wallet custody requirement in the Korean supervisory framework and says the industry-wide cold-wallet share exceeds 95%. Those figures describe the Korean framework and the FSC's cited sector aggregate; they are not Phemex custody ratios or a measure of any single exchange's security.
Cold storage can reduce the amount reachable through an online-wallet attack, but it does not make a venue immune to compromise. Key access, transaction approval, software dependencies, insider controls and recovery procedures still matter. Pushing every coin offline also affects liquidity: an exchange needs a controlled method to replenish hot wallets for legitimate withdrawals. A security policy must therefore specify both exposure limits and transfer authorization. The FSC's discussion of monitoring, insurance and reserves recognizes that prevention and loss handling are different tasks.
The FSC also discussed incident reporting and external security reviews. The press release says the government intends to strengthen obligations through a future Digital Assets Act, while asking businesses to take near-term steps before legislation is enacted. Readers should keep three categories separate: existing law, guidance or supervisory plans announced on 12 November, and provisions expected in future legislation. Blurring them creates a false impression of what is legally effective today.
How can a user tell a platform hold from a network delay?
Start with the venue's withdrawal record and look for a transaction hash, often called a TXID. If the request is pending, under security review or blocked and no TXID exists, the transaction may not have been broadcast. A blockchain explorer cannot confirm an event that has not been sent to the network. The relevant evidence is the venue's status page, authenticated support response and any official incident notice.
If a TXID exists, check it on the explorer for the correct network. Confirm the destination address, asset, amount, block status and number of confirmations. A pending network transaction can reflect fees, congestion or validator processing rather than an exchange-wide suspension. A confirmed on-chain transfer with no balance at the receiving platform points to that recipient's crediting rules or network-support issue. The same asset ticker can exist on multiple networks; checking the wrong explorer can make a valid transfer appear missing.
Phemex's withdrawal FAQ describes where its users can find status information and a TXID, and when to contact support. Those instructions are specific to Phemex. They are linked here because the operational distinction is useful to a reader with a Phemex account, not because the Korean proposal changes Phemex's process. CTA: Check your withdrawal status and TXID. Use the authenticated app or site rather than a link sent by an unsolicited account.
If a platform posts a security notice, record the notice time, affected networks and promised update channel. Do not assume that a pause means user assets have been lost; do not assume it means all assets are safe either. Both conclusions require evidence. If the venue offers a claim or reimbursement process, verify it through its official site. Scammers often exploit incident news by sending fake “unlock” or “recovery” instructions that request a seed phrase or payment. A legitimate exchange support workflow should not require a user to disclose private wallet keys.
What should users do before and during a suspected incident?
Before any incident, secure the account: use strong authentication, review connected applications and maintain a withdrawal-address control if the venue offers one. These measures reduce the chance of account-level compromise but cannot prevent a venue-level outage. Phemex documents its available options in the account-security guide. Enabling or resetting certain controls may itself trigger a temporary withdrawal restriction under venue rules, so make changes before an urgent transfer is needed.
During a pause, preserve records rather than repeatedly submitting transfers. Save the order ID, screenshots of status with time and network, transaction hash if present, and official notices. Contact support through authenticated channels and provide identifiers the venue requests, without sharing passwords, recovery phrases or one-time codes with strangers. If the issue concerns a deposited transfer, include the sending TXID and the receiving network. If it concerns a withdrawal, ask whether the request is still internal or has been broadcast.
For a business holding operating funds on an exchange, a withdrawal pause is also a liquidity problem. The business should know what portion of its working capital depends on a single venue, which assets can be moved through alternative approved channels and whether internal controls allow emergency action. Diversification can reduce concentration but adds counterparty and reconciliation work. The FSC announcement does not establish an optimal allocation; each business must assess its own settlement needs and risk limits.
The November 12 development is most useful as a framework for reading an exchange notice. A preventive hold can be a protective response to a credible signal, while excessive or unexplained holds can harm customers. Disclosure should specify the affected services, why a block is needed at the level possible without worsening security, and when the next update will come. Users should judge a venue by evidence of how it detects, communicates and resolves an incident, not by whether a single pause occurred.
FAQ
Did Korea make every crypto exchange freeze withdrawals?
No. The FSC announced a planned no-action position under conditions for preventive blocks when an intrusion is suspected. It did not order every exchange to stop withdrawals.
Does a pending withdrawal prove an exchange was hacked?
No. A pending request can result from authentication, risk review, wallet processing or network conditions. Check the official status and whether a TXID exists.
Can an exchange reverse a Bitcoin transaction after it has a TXID?
An exchange can stop an unbroadcast request. Once a Bitcoin transaction is broadcast and confirmed, the venue cannot simply cancel that on-chain transfer. Any later recovery depends on the facts and the parties controlling the destination.
Does the Korean proposal apply to my Phemex account?
The FSC release concerns Korean virtual-asset businesses within its jurisdiction. Phemex users should follow Phemex's own withdrawal notices, help instructions and applicable account terms.
