South Korea Weighs Sanctions After Upbit's $36 Million Exploit

South Korea's Financial Supervisory Service has launched a formal sanctions process against Dunamu (Upbit) following a $36 million November 2025 hack, citing gaps in the Virtual Asset User Protection Act that lack direct penalties for cyberattacks. The regulator is expected to close that enforcement gap in phase two of the Digital Asset Basic Act by adding sanctions and compensation provisions for security breaches. If you're running a crypto exchange or custody platform outside South Korea, this is your early warning: regulators are moving from licensing checks to operational resilience audits, and the law will soon penalise hacks directly instead of just slow disclosure. You need to prove strong wallet controls, rapid incident response, and asset segregation before the regulator catches up.