South Korean cryptocurrency exchange Gopax suspended withdrawals and trading on Friday after receiving a hacking-threat email, and said it is moving all held virtual assets into offline cold wallets as a preemptive step to protect customer funds.
Gopax halted standard deposit and withdrawal services at 2:55 p.m. local time and stopped trading at 3:53 p.m., Yonhap News Agency reported, citing the exchange. Direct withdrawals through the website and app are unavailable. Customers who want coins out must apply through the customer support center, where requests are processed manually after internal verification.
“To ensure the safe custody of user assets, we plan to transfer all virtual assets to cold wallets for storage,” Gopax said in remarks carried by Seoul Economic Daily. “Direct withdrawals through the Gopax website or app are temporarily unavailable, and customers wishing to withdraw funds should apply through the Gopax customer support center.”
No actual loss of assets has been reported. The company has not set a date to reopen trading or standard withdrawals.
What Gopax closed and what still works
With trading offline, all open orders were canceled, Chosun Biz reported. Deposits were initially paused with withdrawals; later Korean coverage said deposits had been restored while web and app withdrawals stayed shut. Manual withdrawals through support will take longer than usual.
A cold wallet is a storage setup kept offline, cut off from the internet that hot wallets use to process customer sends. Gopax said the shift of remaining hot-wallet balances into cold storage is meant to shrink the surface available to anyone who can reach online systems.
A Gopax official told Yonhap the email came from a party claiming it could hack the exchange, but that the threat itself had not been verified. “We ask for your understanding, as this measure is intended to prevent financial incidents and protect user assets,” the company said.
A rough stretch for Korean crypto platforms
The freeze lands in a week when exchange security is already under a bright light. On Oct. 29, attackers drained about $6.34 billion from Binance hot wallets in what Binance later described as a months-long campaign that began with a fake job interview. The FBI has tied that theft to North Korea; Binance has reopened withdrawals in stages and said it is covering customer losses from its own funds.
Brazil’s Mercado Bitcoin froze deposits and withdrawals earlier this week after its own security incident, with preliminary estimates of suspicious transfers near $40 million. Gopax’s case is different on the facts disclosed so far: the exchange is describing a threat email and a precautionary lockdown, not a confirmed drain.
Gopax itself has been dealing with account trouble. From early September, abnormal access hit some user accounts, leaking personal information on seven customers and two current or former employees, with further leakage confirmed last month, Yonhap’s Korean dispatch said. The company has treated that breach as separate from Friday’s threat email; any link has not been confirmed.
South Korea’s Financial Services Commission has also been pressing domestic platforms after a broader wave of cybersecurity incidents across financial firms. Korean exchanges are already required to keep at least 80% of customer crypto in cold storage. Friday’s move pushes Gopax further offline while it checks whether the threat is real.
For bitcoin holders on Gopax, the practical effect is a queue: coins are being parked offline while support staff approve outbound sends one by one. That is slower than an app button, and it is the trade the exchange says it is making to keep balances intact.
The test for Gopax now is whether it can finish the cold-wallet transfer, clear the manual withdrawal queue without a loss, and say when trading comes back — or whether the unverified threat turns into the incident it was trying to get ahead of.