South Korean financial regulators will fine hacked crypto exchanges a sum equivalent to up to 10% of their losses, if a leaked draft bill becomes law.

The Financial Services Commission, or FSC, drafted the bill, South Korean newspaper Seoul Kyungjae reported.

The regulator is concerned that exchanges’ cybersecurity and liability laws are too lax.

The FSC’s call comes after domestic market-leading exchange Upbit suffered a breach worth $36 million in late November last year. Had the FSC’s draft bill been law at the time, Upbit would have faced a maximum fine of $3.6 million — 700% higher than the current $456,000 maximum fine.

Strict liability needed

Gina Kim, an independent IT security expert based in Seoul, told DL News that while security systems at exchanges have improved a lot in recent years, they “still appear to fall short of industry gold standards.”

The FSC appears to concur. It noted that the crypto exchange sector needs “IT security standards comparable to those used in traditional financial institutions.”

However, the FSC’s bill may clash with another draft proposal from the government.

Days after Upbit hack, the South Korean news agency Yonhap reported regulators and National Assembly members were mulling a proposal to fine hacked exchanges up to 3% of their annual revenue. For Upbit, which reported revenue of $1.2 billion in 2024, that would amount to $36 million — 10 times as high as would be the case under the new proposal.

Financial Supervisory Service data revealed that a total of 20 security incidents involving customer funds occurred at Upbit, Bithumb, Coinone, Korbit, and GOPAX exchanges from January 2023 to September 2025.

Six of these incidents took place at Upbit, with 616 people affected, and losses amounting to $2.2 million. Four took place at Bithumb, with 326 customers affected, and losses amounting to over $610,000.

Neither Upbit nor its closest rival Bithumb responded immediately to a DL News request for comment on the FSC’s plans.