Gopax halts withdrawals and trading after a hacking-threat email, with no loss reported and no restart date

Gopax, the Seoul crypto exchange whose majority owner is Binance, suspended crypto deposits, withdrawals through its website and app, and all trading on Friday 6 November, after it received an email from a group claiming to have hacked the exchange. Withdrawals stopped at 14:55 KST (05:55 UTC) and trading at 15:53 KST (06:53 UTC), according to two notices the company posted the same afternoon. Gopax says it has not verified the threat and reports no loss of customer assets. No restart date has been given.

The first notice, number 2607, went up at 14:49 KST (05:49 UTC). It says Gopax will move all of its customers’ crypto into cold wallets, storage kept off the internet, and that withdrawals will now be handled by hand through customer support. The second notice, number 2608, followed at 16:17 KST (07:17 UTC) and confirmed that trading had stopped and every open order had been cancelled. Neither notice mentions the email.

The email came out through the press. A Gopax official told Yonhap news agency: “We received an email from a group claiming to have hacked the exchange,” adding that “we have yet to verify whether the threat is genuine.” The official said the exchange was putting customers’ assets first “even if this causes inconvenience to users.”

What Gopax stopped, and how withdrawals work now

The halt came in two steps a little under an hour apart. The times below come from the company’s notices and its notice feed, in Korean time (KST, UTC+9) and UTC.

Customers who want their coins out are told to write to the exchange’s support desk at [email protected]. Each request goes through an internal check and approval and is then processed manually, one after another, so it may take longer than a normal withdrawal, the notices say. Notice 2608 links to a help page on how to file the request. Neither notice gives a daily limit, a fee change or a target time for processing.

Deposits are the least clear part. Notice 2607 lists crypto deposits as suspended, and notice 2608 says the deposit and withdrawal service was stopped earlier in the day. Bitcoin Magazine reported on 6 November that later Korean coverage said deposits had been restored while app withdrawals stayed shut. Gopax has posted nothing that confirms a restart of deposits: when we checked its notice feed at 17:50 UTC (02:50 KST on Saturday), the newest item was still 2608. Anyone about to send coins to a Gopax address has no written confirmation from the exchange that they would be credited.

Trading is off entirely. Every resting order was cancelled at 15:53 KST, so customers’ funds sit in their accounts as balances, not as orders waiting to fill.

A hacking claim that Gopax has not verified

What is known about the threat itself is thin. Herald Business reported that Gopax received one email, from a group presenting itself as hackers. None of the outlets that covered the halt named the sender, a ransom or any other demand, or a deadline. Segye Ilbo, writing at 19:33 KST, also gave none of those details.

Gopax’s line is that it acted before anything happened. A representative told Kyunghyang Shinmun, as cited by Cointelegraph, that no hack or attempted theft had taken place at that point. The company told JKN that no actual damage to assets had been identified and that a schedule for restarting services had not been set. Herald Business wrote that Gopax could not confirm whether the email was authentic but judged an attack possible, and moved first.

The exchange had already had a security problem this autumn. Abnormal access to some accounts from early September exposed personal data of seven users and two current or former employees, and a further leak was confirmed in October, JKN and Segye Ilbo reported. Gopax told JKN it treats that leak and the threatening email as separate matters, and no link between them has been confirmed.

There was also a short disruption the day before. A Gopax notice of 5 November said deposits and withdrawals of some coins were delayed from midnight because of an outage at Chainalysis, an outside service, and were back to normal at 10:52 KST. The notice says nothing more, and Gopax has not tied that outage to Friday’s halt. Chainalysis had disclosed a breach of its own a week earlier, described in our report on the Chainalysis incident; no source connects it to Gopax.

Regulator’s advice or Gopax’s own call: two versions

Gopax has given two accounts of who decided the halt, and they do not match.

The written notices say the exchange is acting “in line with the financial authorities’ recommendation”, in response to recent data leaks and hacking incidents at financial companies, and call the step pre-emptive. Both notices 2607 and 2608 carry that wording.

What Gopax told reporters is different. A company official told Etoday, in an article posted at 19:22 KST, that after receiving the threat email Gopax decided on the pre-emptive measures itself and passed the details to the authorities. Herald Business also described the halt as the company’s own decision and did not mention a regulator. Etoday quoted Gopax as confirming that it did receive a hacking-threat email.

The notices do not say which recommendation they refer to. The Financial Services Commission (FSC) met exchanges on 2 November, and the requests reported from that meeting concern cold storage, monitoring and reserves; none of the reports mentions a trading halt. We found no statement from the FSC, the Financial Supervisory Service or the Financial Intelligence Unit about Gopax’s suspension by the time of writing.

The 80% cold-storage rule and the 2 November meeting

Korean rules require exchanges to keep at least 80% of customers’ crypto in cold storage, Cointelegraph noted. Gopax was close to that floor: it held 80.54% of user assets offline at the end of September, according to the same report. The Seoul Shinmun published the end-of-September ratios of the main won exchanges on 3 November.

Those figures were part of the backdrop to an emergency meeting the FSC called at 10:00 KST on 2 November, after the Binance hack. The Financial Supervisory Service, the Financial Security Institute, the exchange alliance DAXA and officials from the main exchanges attended, the Seoul Shinmun reported. The regulator asked exchanges to raise the share of assets in cold wallets, watch deposits and withdrawals around the clock with more staff, set aside more reserves, and report and share any abnormal access attempts. It is also reviewing an industry request to let exchanges restrict withdrawals quickly when another exchange is hacked; no decision has been announced.

By moving everything into cold wallets, Gopax goes well past the 80% floor, at least for now. The cost is speed. Coins in a hot wallet sit on internet-connected systems and can be sent in minutes; coins in cold storage need offline signing, which is why withdrawals now go through a manual queue. Our glossary entries on the cold wallet and the hot wallet explain the difference, and our guide to how a centralized exchange works covers what customers own when coins sit on a platform.

Gopax was already on the regulator’s list. In October the FSC reported cybersecurity weaknesses at 130 of 555 financial companies it reviewed and named Gopax’s operator, Streami, and the exchange Prabang among 16 firms involved in earlier security incidents, according to Cointelegraph. Prabang found abnormal withdrawals from its hot wallet on 24 October, lost about 100 million won (about $70,000) according to Cointelegraph, and said it would repay customers with company funds. Separately, the FSC said incidents had been confirmed at 37 financial institutions, affecting about 470,000 customer records, Yonhap reported on 6 November.

Banks are being asked questions too. The Bank of Korea has asked banks and brokerages how a halt at an exchange or a crypto crash would hit them, as covered in our report on the Bank of Korea’s survey.

Binance owns the majority of Gopax, and no source links the halt to its hack

Binance is Gopax’s majority owner. It announced its investment in 2023, but the change of major shareholder sat with South Korea’s Financial Intelligence Unit from March 2023 until the unit approved it in October 2025, Decrypt reported on 17 October 2025, citing concerns over Binance’s compliance history. Outlets give different percentages for the stake, and Gopax’s notices do not state one.

The deal had its roots in an earlier freeze. In November 2022, after lender Genesis Global halted redemptions, Gopax suspended payouts of principal and interest on GoFi, its savings product that brokered Genesis products, Forkast reported on 18 November 2022. Gopax said then that GoFi assets were kept apart from the trading platform’s user assets. When the FIU approved Binance’s purchase, Gopax described it as progress toward repaying GoFi users, according to Decrypt.

The timing invites a link to the Binance hack, covered in detail in our main report on the Binance hack. None of the sources makes one. Cointelegraph and Cryptopolitan cite the theft only as the reason Korean regulators pushed for more cold storage, and Gopax’s notices refer to incidents at financial companies in general, not to its owner.

What is still unknown before Gopax reopens

Several questions have no public answer. No outlet has reported who sent the email, what it asked for or whether it set a deadline. Gopax has not said whether it now thinks the threat is credible, or how long the transfer of all assets to cold wallets will take.

There is no restart date. Gopax told Etoday it will announce a resumption once safety is secured, and Herald Business quoted the company as saying the timing has not been decided. The status of deposits is unclear until the exchange says otherwise in a notice.

Nor is it known whether other Korean exchanges received a similar email; no outlet reported one. The FSC has not commented on Gopax in public, so the gap between the notices’ wording and the company’s account to reporters stays open. The next fact to watch is a new entry on Gopax’s notice board after 2608.