According to Yonhap News, from 2020 to April 2026, South Korea's top five virtual asset exchanges—Upbit, Bithumb, Coinone, Korbit, and Gopax—experienced a total of 57 hacker attacks and system failures, with total compensation amounting to approximately 7 billion KRW (about $5.1 million). The incidents broke down as: Upbit 26, Bithumb 14, Gopax 8, Coinone 6, and Korbit 3.
Bithumb Erroneously Sent 620,000 BTC, Single Incident Compensation Hits Record
In February 2026, Bithumb suffered a rare Bitcoin mis-sending incident where 620,000 BTC were incorrectly withdrawn. Within 35 minutes, Bithumb froze accounts and recovered 99.7% of the assets, offering a 110% compensation package to users who sold in panic. This compensation amounted to about 2.5 billion KRW ($1.8 million), the highest single-incident payout in six years.
On November 27, 2025, Upbit was hacked, losing approximately 54 billion KRW ($37 million) in Solana ecosystem assets, allegedly by North Korea's Lazarus group. Upbit announced full compensation from company assets, totaling about 790 million KRW ($570,000). Additionally, a system failure on December 3, 2024, led to compensation of around 3.2 billion KRW ($2.3 million). Cumulative system failure compensation: Upbit ~3.21 billion KRW, Bithumb ~3.2 billion KRW, Coinone ~49 million KRW; Korbit and Gopax provided no compensation.
Inconsistent Incident Definitions and Compensation Methods
The exchanges use vastly different criteria for what constitutes an "incident." Gopax counts display errors in asset lists as system failures; Bithumb applies a stricter threshold, only recording failures when all users face core service interruptions exceeding 10 minutes. Compensation forms also vary: Bithumb offered free fee vouchers instead of cash to some claimants. This inconsistency exposes the lack of unified standards for incident disclosure and compensation in Korea's crypto market. In March 2026, Bithumb also faced a preliminary notice of partial suspension for six months due to AML/KYC violations, adding to regulatory pressure.
FSC Pushes No-Fault Liability Legislation, Reshaping Trust in Crypto
South Korea's Financial Services Commission (FSC) is reviewing a major legislative revision centered on introducing a "no-fault liability" mechanism: requiring virtual asset service providers to unconditionally compensate users for losses from hacks or system failures, with potential fines of 3% of annual revenue for hack incidents. If the bill passes by the first half of 2026, South Korea would become one of the few global crypto markets to mandate no-fault liability for exchanges. For platforms like Upbit and Bithumb with billions in daily trading volume, this is not just a compliance cost but a chance to redefine "trust."