At 2:55 p.m. on Nov. 6, Gopax, a Korean crypto exchange where people trade coins for won (the Korean currency), halted deposits and regular withdrawals. Its operator is Streami. At 3:53 p.m. it also stopped trading and canceled every open order. The trigger was an email threatening to hack the exchange. The company said there was no actual hack or attempted theft, and no asset losses have been reported.
When an exchange shuts its doors, people first think either "it got hacked" or "the company is in trouble." But the real issue lies elsewhere. It is where Gopax kept customer coins, and how much of them it kept there. This is not a reason the company or the press gave directly. It is an interpretation based on the published custody ratios.
- What is Gopax doing while it is halted?
In its notice, Gopax said it is moving all of its crypto assets into cold wallets, which are wallets physically disconnected from the internet. Exchange wallets come in two kinds. A hot wallet is connected to the internet and pays out withdrawals instantly. A cold wallet is relatively safe from hackers, but its coins cannot be taken out right away.
So the way withdrawals work has changed. Withdrawing directly on the website or app is blocked. Customers must apply separately through customer service, and each request is checked, approved and processed by hand, one at a time. Gopax itself said this may take longer than usual. It has not said when trading and withdrawals will reopen.
Think of a bank's teller window and its vault. It is like a bank that gets a robbery threat and stops serving customers while it carries the cash from the counter into the vault. The difference is that the coins in an exchange wallet are not the bank's money. They belong to customers.
- Gopax cleared the 80% legal minimum by just 0.54 percentage points
Under the Virtual Asset User Protection Act, a law written to protect crypto users, an exchange must keep at least 80% of the economic value of customer coins in cold wallets. According to Financial Supervisory Service data, Gopax's cold wallet ratio at the end of September was 80.54%. At the same point, Upbit was at 99.17%, Bithumb at 94.76% and Coinone at 85%.
Put simply, Gopax was keeping customer coins online almost as much as the law allows. At the end of September, the online share was about 19.46% at Gopax and about 0.83% at Upbit.
Say a customer holds 10 million won in coins. Then roughly 1.95 million won of it would sit in internet-connected wallets at Gopax, versus roughly 80,000 won at Upbit. This is a hypothetical calculation that applies each exchange's overall ratio. It does not show where any one customer's coins actually are.
- Why did one threat force it to shut down?
Hackers go after hot wallets, the ones connected to the internet. When a threat arrives, an exchange's surest defense is to empty its hot wallet. While it does that, it cannot pay out withdrawals automatically, so customers cannot take out their coins. Gopax stopped trading as well while it moved the coins.
The more there is to move, the longer this takes. At the end-September ratios, the share Gopax kept online was about 23 times Upbit's. Even facing the same threat, the amount left outside the vault is very different.
The timing was also sensitive. On Oct. 29, about $6.3 billion in coins was stolen in a hack of Binance, the world's largest crypto exchange. On Nov. 2, the Financial Services Commission held an emergency meeting with major exchanges and urged them to keep more customer assets offline. In October, Gopax also disclosed a leak of personal data belonging to seven customers and two employees. It has not been confirmed whether that is linked to this threat email.
- How is this different from an exchange that was actually hacked?
Something similar happened less than a month ago. On Oct. 24, the Korean exchange Pravang spotted abnormal withdrawals from its hot wallet and suspended service. The loss was about 100 million won, and the company said it would repay customers out of its own money.
Gopax is different. No losses have been reported so far. Instead, what customers have paid is time. They cannot trade, and they must wait their turn at customer service to withdraw. On a day when coin prices are moving, that means they cannot sell even if they want to.
- Why do regulators want to raise the bar to 99%?
Regulators are considering raising the minimum cold wallet requirement to 99%. However, no final decision or new mandatory standard has been announced. The US exchange Coinbase is reported to keep more than 99% of customer coins in cold wallets.
If the standard becomes 99%, the share an exchange can keep online drops to 1% or less. Even if a threat arrives, there is little to move, so there is less reason to stay closed for as long as Gopax has.
- BITPRESS Insight
In this case, what locked up customer coins was not a hacker but the roughly 20% left outside the vault. An exchange sitting right at the legal minimum has to move the remaining share on a threat alone, even with no actual hack, and customers can neither trade nor withdraw in the meantime.
By contrast, an exchange with a cold wallet ratio near 99% has almost nothing to move when it faces the same threat. A clean hacking record is about the past. The cold wallet ratio shows what will happen when the next threat arrives.
When choosing an exchange, "how much of its customers' coins does it keep in the vault?" matters more than "has it ever been hacked?" It decides whether you can take out your coins right away when a threat comes.
Sources
https://en.sedaily.com/finance/2026/11/06/gopax-halts-withdrawals-after-hacking-threat
https://cointelegraph.com/news/gopax-halts-crypto-trading-withdrawals-cold-storage
https://crypto.news/gopax-halts-trading-withdrawals-hacking-threat/
Glossary
cold wallet — A crypto wallet physically disconnected from the internet. It is relatively safe from hackers but hard to take coins out of quickly.
Hot wallet — A wallet connected to the internet that pays out withdrawals instantly. It is convenient but a target for hackers.
Virtual Asset User Protection Act — A law to protect crypto users that requires exchanges to keep at least 80% of customer coins in cold wallets.
Open order — An order to buy or sell that has been placed but has not yet been filled.
BITPRESS articles are information to help your investment decisions, not a recommendation to buy or sell any stock or coin. Investment decisions and their results are your own responsibility.
