South Korea’s Financial Services Commission has ordered all cryptocurrency exchanges to implement near real-time asset reconciliation and submit to monthly external audits.
Singapore Summit: Meet the largest APAC brokers you know (and those you still don’t!).
The directive follows a February operational failure at Bithumb that briefly sent $56 billion worth of bitcoin to hundreds of retail users.
The Bithumb Incident
On February 6, 2026, Bithumb mistakenly credited approximately 620,000 BTC (worth around $56 billion at the time) to hundreds of users during a promotional event.
The intended payment was 620,000 Korean won, roughly $450. Some recipients sold the bitcoin immediately, causing a localized price drop of 10–17% on the exchange.
Bithumb froze affected accounts and recovered most of the funds, but the FSC concluded the episode exposed “structural vulnerabilities” in the industry’s internal controls.
The New Requirements
The FSC has set an end-of-May deadline for all Korean exchanges to comply with a new operational framework.
The key requirements:
- Reconciliation every five minutes: exchanges must verify client ledgers against on-chain holdings at five-minute intervals, compared to the 24-hour cycle most currently use.
- Daily public disclosure of reconciliation results.
- Monthly independent audits by an external accounting firm.
- Upgraded trade-halting systems capable of acting immediately on a large asset mismatch.
What This Means for the Industry
The rules represent one of the first times a major regulator has applied high-frequency internal audit requirements — the kind typically associated with stock exchanges and clearing houses — directly to crypto platforms.
The focus is on operational risk: internal failures that occur without any external breach, a category the industry has historically treated as secondary to cybersecurity.
The requirements are expected to be codified under South Korea’s forthcoming Digital Asset Basic Act. Whether other jurisdictions follow a similar model remains to be seen — but Bithumb’s error has given regulators a concrete failure case to point to.
