GOPAX Stops Trading After a Hack Threat: Manual Withdrawals and a Full Move to Cold Storage

GOPAX stopped the clock. The South Korean exchange suspended trading, cut off deposits and shut down standard withdrawals after detecting a hacking threat, leaving customers to file manual withdrawal requests through its support desk while every asset it holds moves into cold storage.

That's the short version. The longer version is about what an exchange actually does in the hours after somebody knocks on the door, and how much of that response is security work versus reputational triage.

The Order of Events

The sequence matters more than the headline. Threats don't arrive as explosions. They arrive as a message, a proof-of-concept screenshot, or a wallet signature that shouldn't exist. GOPAX says it picked up the threat and pulled the brakes.

Order of operations, as it stands. First, trading stops. Then deposits. Then the standard withdrawal button, the one every user expects to work at 3 a.m. on a Sunday, goes dark. What's left is a human being on the other end of a support ticket, reviewing each request one at a time.

Then came the second shoe. GOPAX said all assets are moving to cold storage.

Read that again. Not some assets. Not the treasury. Everything.

For anyone who has watched Korean exchanges stumble through the last few years, the shape of this is familiar. GOPAX spent a chunk of 2023 with withdrawals frozen over its exposure to Delio, the lending platform that went sideways and took a lot of customer confidence with it. Binance bought into the exchange in early 2023 and later trimmed its stake hard. The venue has been rebuilding ever since, and rebuilding is expensive when your product is trust.

So here's the thing. A hacking threat is a security event. A trading halt is a business event. GOPAX just ran the second one to survive the first.

What Actually Breaks

Cold storage protects assets. It doesn't protect the business.

Moving coins offline is the easy part. An exchange can do it in an afternoon with a laptop and a hardware wallet. The damage happens on the other side of the ledger, where users discover they can't exit, can't trade, and can't see a timestamp for when either comes back.

Manual withdrawals are the tell. If the threat were fully contained and the architecture were sound, you'd see a withdrawal queue, not a support ticket. A support ticket means a human is checking each request by hand, which means throughput measured in dozens per hour, not thousands per minute. Queues like that start dripping with panic around hour six.

Ask yourself this. If the situation is serious enough to stop trading entirely, why is the escape hatch a customer service email?

Now the market share question. On won-denominated volume, Korea's big four do the heavy lifting. GOPAX sits well behind Upbit, Bithumb, Coinone and Korbit. Losing a week of trading costs the exchange less than it would cost a market leader. What it costs is the marginal user, the one who was already nervous and now has a tab open on a competitor's signup page.

And there's a regulatory layer people outside Korea tend to skip. The Virtual Asset User Protection Act took effect on July 19, 2024. It requires exchanges to keep at least 80% of user deposits in cold wallets, hold reserves equal to user liabilities, and separate customer assets from company assets. GOPAX's full migration to cold storage isn't just incident response. It's also the boring, legally mandated default that every Korean exchange has been living with for over a year.

Which raises the good question. If 80% was already supposed to be offline, what was in the hot wallet, and why was it reachable?

That's not an accusation. It's the arithmetic of the rule. Every exchange in the country keeps a hot slice for operations, and the hot slice is where the risk lives. The Upbit breach in November 2019 took 342,000 ETH, about $49 million at the time, straight out of a hot wallet. No cold storage policy on earth would have touched that loss after the fact. Six years later the industry still argues about the same 20%.

Here's the takeaway nobody wants to print. A hack threat that produces no stolen funds can still cost more than a hack. Trading fees stop. Deposits stop. Withdrawals crawl through a support queue. Legal and forensic bills start accruing the moment outside firms get the call. Cold storage is the cheap part.

The Next 72 Hours

Watch three things.

First, the withdrawal queue. If manual processing clears in a day or two, this reads as a cautious operator taking a real threat seriously. If requests stretch past a week, you get the 2023 pattern again, and Korean crypto users have long memories about frozen balances.

Second, the audit trail. Expect a statement on reserves, ideally one that's verifiable rather than a screenshot with a number on it. Attestation beats assurance here. Korea's regulators have been pushing exchanges toward third-party verification, and the Financial Supervisory Service has a habit of asking pointed questions when a venue self-reports a threat.

Third, whether anyone else follows. Korean exchanges share threat intelligence more than they advertise, and a credible extortion attempt against one venue usually means the same crew is working the list. If Bithumb or Coinone quietly tighten withdrawal limits in the next two weeks, that's the signal. Not a press release.

And keep an eye on the reuse problem. Threats that succeed tend to get copied, and the ones that fail get retried with a bigger number attached.

Korea's market has done this before. It survived a four-month shutdown of an exchange's withdrawals in 2023 and came out with stricter rules on the other side. The lesson worth carrying forward is simple. Custody is the whole product. Trading is what you do with the time left over.

Enterprise blockchain is boring. That's why it works. But exchanges aren't enterprise software. They're vaults with a chat window attached, and vaults get tested.