South Korea plans to require cryptocurrency exchanges to bear "no-fault liability for damages," with the Upbit hacking incident serving as the trigger.

According to Odaily, the South Korean government is pushing forward legislation to introduce a "no-fault compensation" rule similar to that in the banking industry for major cryptocurrency exchanges. It is understood that the Financial Services Commission (FSC) of South Korea is evaluating the possibility of requiring virtual asset service providers to bear liability for compensation even if they are not at fault, in cases of user losses caused by hacking attacks or system failures.

Currently, such mandatory compensation only applies to traditional financial institutions and electronic payment companies.

This policy move stems from a security incident that occurred on the Upbit platform on November 27, in which approximately 44.5 billion won (about US$30.1 million) in assets were transferred to external wallets within 54 minutes, and regulators were unable to force the platform to compensate under current regulations.

South Korean financial regulators also pointed out that the cryptocurrency trading industry has experienced frequent system failures in recent years. Data shows that from 2023 to September of this year, the five major exchanges experienced a total of 20 system failures, affecting more than 900 users and resulting in a cumulative loss of approximately 5 billion won. Upbit accounted for six of these failures, with losses amounting to approximately 3 billion won.

The draft also proposes to raise technical security requirements and increase the maximum penalty for hacking incidents to 3% of annual revenue, the same as traditional financial institutions, which is higher than the current fixed limit of 5 billion won.

Furthermore, Upbit's incident has sparked controversy over "delayed reporting." The platform detected the anomaly at 5:00 AM but only reported it to regulators at 10:58 AM, leading some lawmakers to question whether it intentionally waited until the merger process between its parent company, Dunamu, and Naver Financial was completed before disclosing the information. Regulators are investigating the matter, but under the current framework, it is unlikely that severe penalties will be imposed. (Korea JoongAng Daily)