Gopax hack explained: Korea's 16-firm breach and what we know

A wave of cyberattacks on South Korea's financial sector has reached crypto exchanges. On October 14 regulators named 16 affected firms, from Shinhan and KB Kookmin banks to Streami, the operator of the Gopax exchange, and the Pravang exchange. About 100,000 personal records were exposed in total. No crypto appears to have been stolen: Gopax says it saw login attempts on a handful of accounts with no losses, and Pravang reported data on about 20 customers was taken.

What we know now

• The victim count is 16, up from seven in early October. About 100,000 records were exposed in total: names, contact details, resident registration numbers and emails. No account numbers, card numbers or passwords were found among them.
• Regulators have not broken down the records by firm; the 100,000 figure covers all 16, not Gopax alone.
• Gopax: attackers tried to log in with emails and passwords leaked earlier from other websites. Fewer than ten accounts were targeted, no customer assets were lost, and the exchange says no personal data leak has been confirmed.
• Pravang: on October 2 an outsider obtained data on about 20 customers; the exchange disclosed it on its website on October 9.
• Regulators believe AI agents may have driven the attacks on the sector and are checking whether one actor is behind them. Gopax says its case involved no AI and is unrelated to the Shinhan breach.
• The list may grow as firms check their access logs against attacker IP addresses.

How it happened

The wave involves two different scenarios. The main one, according to regulators and Korea JoongAng Daily, is the breach of weakly protected internet-facing services: at Shinhan it was a portal for loan agents, where attackers bypassed identity checks and pulled data on about 25,000 customers. An inspection of 555 financial firms found shortcomings at 130, including missing patches, unsupported systems, no 24-hour monitoring and weak access controls on external systems.

The AI angle was described by NoCutNews: back in September the Financial Security Institute presented an attack on a Korean financial firm in which the attacker told an agent built on China's DeepSeek model to find Oracle WebLogic servers in the sector; the next day the agent exploited a vulnerability and planted a web shell. According to the outlet, the current wave used ARTEX, a Chinese penetration-testing tool that combines several AI models. Police and regulators have not officially confirmed this.

Gopax says its case was different and simpler: credential stuffing. Attackers take email-and-password pairs from old leaks at other sites and try them on the exchange, which works when people reuse passwords. Gopax's abnormal-activity monitoring flagged the attempts.

Timeline

September 17. The Financial Security Institute walks security officers through an AI agent attack on a Korean financial firm at a seminar (NoCutNews).

October 1. Shinhan Bank says outsiders obtained data on about 25,000 customers, including names, phone numbers, income and loan limits (Korea JoongAng Daily). KB Kookmin (119 people), Hana (89) and BNK Busan (11) later report smaller leaks.

October 2. An outsider, according to Pravang, gains access to some of its services and data on about 20 customers (BizWatch).

October 4. Financial Services Commission (FSC) Chairman Lee Eog-weon tells a sector-wide emergency meeting that AI-driven attacks cannot be ruled out (MTN).

October 9. Pravang posts a breach notice on its website: names, gender, nationality, date of birth, phone, address, employer and job title were exposed.

October 11. NoCutNews reports the AI angle: a DeepSeek-based agent and the ARTEX tool, with a command server in Hong Kong and obfuscated access routes used in the bank attacks.

October 14, by 3:15 AM ET. At a second emergency meeting of the FSC, the Financial Supervisory Service and the Financial Security Institute, the victim count rises to 16, including Streami (Gopax) and Pravang; about 100,000 records were exposed (Seoul Economic Daily).

October 14, 4:08 AM ET. Gopax explains that repeated logins were attempted on a few accounts using passwords leaked from other sites, there were no losses, the account holders were warned and regulators were notified the day it was detected.

Where the money went

None of the 16 firms has reported theft of money or crypto. What leaked was personal data, not funds. Apart from Pravang's roughly 20 customers, it is not known how many records came from Gopax or Pravang.

What the exchanges and regulators did

Gopax reported the attempts to regulators, notified the account holders individually, and says it will cooperate with authorities and speed up planned system upgrades. Pravang activated emergency response, blocked the attackers' IP addresses and is monitoring for abnormal logins.

Regulators are sharing attacker IP addresses across financial firms, ordering checks of all internet-facing services and requiring vulnerability checks at least twice a year instead of once. Greater accountability for CEOs and boards is also on the table. "It is deeply troubling that financial firms are still failing to meet basic security requirements," FSC Secretary General Shin Jin-chang said.

What it means for holders

Gopax has no token of its own, and the story has not moved the market. Gopax is one of Korea's won-based exchanges; in 2023 Binance bought a controlling stake in its operator.

The main risk for customers is not theft from exchanges but phishing: with a name, phone number and email, scammers can pose as an exchange or bank. Exchanges never ask for login codes or seed phrases. The Gopax case is also a reminder about password reuse: credentials leaked from any site later get tried on exchanges, so a unique password and two-factor authentication matter.

This story is developing: we are following events and adding new information. Last updated October 14, 2026, 6:00 AM ET.

This is not investment advice.