In this article4 sections
South Korea’s GOPAX halted trading, deposits and standard withdrawals on Friday, November 6, 2026, after an email threatened a hack, according to Cointelegraph, which cited the newspaper Kyunghyang Shinmun. A GOPAX representative told the paper that no hack or attempted theft had occurred at that point.
Deposits and normal withdrawals stopped at 5:55 am UTC and trading ceased at 6:53 UTC, per a second exchange notice. All unfilled orders were canceled. Customers can still ask for withdrawals through the support center, though GOPAX warned that manual checks and approvals could slow processing.
Also read: Coinbase Drops 12.5%, Strategy 6% as Binance Breach Hits Stocks
Key facts
- GOPAX suspended deposits and standard withdrawals at 5:55 am UTC and trading at 6:53 UTC on November 6, 2026, canceling all unfilled orders.
- The exchange said it would move all crypto assets into offline wallets, citing financial regulators’ recommendations and recent leaks and hacks at financial institutions.
- Days earlier, South Korea’s Financial Services Commission urged domestic exchanges to raise cold-wallet holdings after the $6.3 billion Binance hack; South Korean exchanges must keep at least 80% of customer crypto offline.
- Financial Supervisory Service data showed GOPAX held 80.54% of user assets offline at the end of September, near the required minimum.
- The FSC named GOPAX operator Streami and exchange Prabang among 16 companies tied to earlier security incidents, per Cointelegraph.
Regulators push exchanges toward cold wallets
The halt came in a week when custody practices drew fresh attention. Bitcoin.com News reported that Coinbase said on November 4 that more than 99% of customer assets sit in offline cold storage after the Binance breach on October 29. Coinbase said the incident did not affect its infrastructure or customer funds and reported $377 billion in platform assets as of September 30, along with $8.6 billion in cash and equivalents and $2.2 billion in crypto held for investment.
CoinCentral reported that Coinbase described a multiparty computation setup that splits signing power, plus withdrawal limits, anomaly detection and controls that can stop transaction signing, and that Coinbase Vault can require several approvals before a withdrawal. Bitcoin.com News noted the 99% figure is self-reported and has not been independently established by third parties. Both the Bitcoin.com News and CoinCentral accounts put Binance’s theft in the billions and describe a social engineering campaign that began with a fake job interview; CoinCentral added that Binance said on Wednesday it had replenished about 98% of affected assets.
Why it matters
GOPAX’s move turns a threat email into a self-imposed outage, showing how quickly a warning can shut an exchange in a market where regulators are already pressing for offline custody. The rule that South Korean exchanges must keep at least 80% of customer crypto in cold storage puts GOPAX’s 80.54% figure close to the line, so shifting the remainder offline is a direct response to both the email and the regulator’s stance. For users, the practical change is slower access: trading is paused and withdrawals are manual. It also arrives days after the Binance theft and alongside a separate incident at Prabang, another South Korean venue, which suspended services after detecting abnormal hot-wallet withdrawals on October 24 and reported about 100 million won ($70,000) in losses, according to Yonhap News Agency via Cointelegraph.
What to watch
Whether GOPAX restores deposits and automated withdrawals, and when the planned transfer of assets to offline wallets is completed, are the next concrete markers. Also worth watching: the FSC’s tighter cybersecurity oversight plans for the 16 companies it identified after reviewing 555 financial firms, of which it reported deficiencies at 130 in October.
Reported by Cointelegraph.
Sources: Cointelegraph, Bitcoin.com News, CoinCentral