Due to the Upbit hack... Financial authorities to push for 'no-fault compensation' in the virtual asset industry

Source: DigitalToday
Original Title: In Response to Upbit Hacking… Financial Authorities Push for ‘No-Fault Compensation’ in the Virtual Asset Industry
Original Link: https://www.digitaltoday.co.kr/news/articleView.html?idxno=610807

If hacking or system failures occur at virtual asset exchanges, a plan is being promoted to impose ‘no-fault liability for damages’ on operators, just like financial companies.

This comes after criticism that, despite a recent hacking incident at Upbit involving over 40 billion KRW, there is currently no legal basis for imposing sanctions or mandatory compensation.

The Financial Services Commission is reviewing the inclusion of a provision in the forthcoming ‘Phase 2 Virtual Asset Legislation’ that would also hold virtual asset operators liable for no-fault compensation in the event of hacking or system failures.

Under the current Electronic Financial Transactions Act ((EFTA)), financial companies and electronic financial businesses are required to compensate users for damages incurred due to hacking or system failures, unless the user acted intentionally or with gross negligence.

However, virtual asset operators are not subject to the EFTA, making it difficult to hold them accountable for hacking or system failures.

The recently enacted ‘Virtual Asset User Protection Act’ ((Phase 1 Law)), which came into effect last year, also lacks provisions related to hacking or system failures, making it difficult for the recent Upbit incident to result in severe penalties.

The head of the Financial Supervisory Service also mentioned the Upbit incident at a recent press conference, stating, “Trust in safety and system security is the lifeblood of the virtual asset market. We are strengthening these aspects in Phase 2 of the virtual asset legislation.”

System failures, in addition to security breaches, are also occurring consistently.

According to data submitted to the Financial Supervisory Service, from 2023 to September 2025, there have been a total of 20 system failures across the five major KRW-based exchanges ((Upbit, Bithumb, Coinone, Korbit, GOPAX)).

Specifically:
▲ Upbit: 6 cases ((616 victims, 3,199.67 million KRW in damages))
▲ Bithumb: 4 cases ((326 victims, 883.08 million KRW))
▲ Coinone: 3 cases ((47 victims, 49.65 million KRW))

Korbit and GOPAX had 1 and 6 incidents respectively, but there were no compensation claims.

The Phase 2 virtual asset legislation is expected to reflect much of the current EFTA’s requirements for securing safety and reliability, as well as penalty provisions.

It is known that requirements for operators to maintain proper staffing, facilities, and electronic devices, and to submit annual IT-related plans to the Financial Services Commission, will be included.

Discussions are also underway to strengthen hacking-related penalties to the level of the EFTA.

Currently, a proposed amendment to the EFTA is pending in the National Assembly, which would allow fines of up to 3% of sales for financial companies that experience hacking incidents. If passed, a similar level of fines would likely apply to virtual asset operators. The current maximum fine is capped at 5 billion KRW.

A financial authority official explained, “If the EFTA amendment significantly strengthens the penalty levels, we are discussing aligning the standards for virtual asset operators accordingly.”