A report from the Korea Internet Security Agency (KISA) reveals that many South Korean cryptocurrency exchanges lack ISMS-P certification, a key standard for personal information protection. Of the six non-Korean won exchanges that registered or renewed their VASP certifications this year, five only hold basic ISMS certification, which does not cover personal information protection. Major exchanges like GOPAX also lack ISMS-P certification. Additionally, large exchanges such as Upbit, Bithumb, and GOPAX are criticized for insufficient security investment, allocating only about 10% of their IT budgets to security. These exchanges also have a low percentage of personnel dedicated to security, with Upbit at 9%, Bithumb at 10.2%, and GOPAX at 12.5%. Coinone and Korbit, the third and fourth largest exchanges, have not disclosed their security measures.