Regulatory Action: South Korea Moves to Sanction Upbit Operator

South Korean financial regulators have formally initiated sanction procedures against Dunamu, the operator behind the major cryptocurrency exchange Upbit. This move comes in the wake of a significant security breach that resulted in losses amounting to 445 billion won.

Investigation Focus: Breach of User Protection Act

The Financial Supervisory Service has been conducting an investigation since the hack occurred, primarily examining whether Dunamu violated the country's Virtual Asset User Protection Act. This legislation sets forth stringent requirements for digital asset exchanges regarding security measures and safeguarding user assets.

Uncertain Path to Penalties

The outcome of the sanction process remains uncertain due to a notable legal gap. Current South Korean regulations lack specific penalty provisions directly addressing incidents like hacking or computer system failures. Consequently, regulators cannot penalize the company solely based on the occurrence of the breach itself.

Instead, the FSS must establish that Dunamu failed in its specific duties—such as implementing adequate security protocols, risk management, or post-incident response—as mandated by law. Whether this investigation will lead to substantial disciplinary action is still unclear.

The Road Ahead: Review and Final Decision

Following standard procedure, the FSS will issue a preliminary notice to Dunamu outlining the alleged violations and proposed sanction levels after reviewing the company's explanation.

The final decision will be determined through a multi-tiered review process:

  • The FSS concludes its investigation and issues a preliminary sanction opinion.
  • Dunamu exercises its right to present a defense against the allegations.
  • The case is reviewed by an independent Sanction Deliberation Committee.
  • A final ruling requires a resolution passed jointly by the Securities and Futures Commission and the Financial Services Commission.

This case represents a critical test for the enforcement of South Korea's Virtual Asset User Protection Act. Its resolution will set a significant precedent for defining security responsibilities and regulatory compliance for crypto exchanges both within South Korea and internationally.