Hackers Breach Korean Crypto Exchanges Gopax and Pravang

South Korea's financial regulators said on October 14 that a wave of cyberattacks on the country's financial sector has now hit 16 firms, including two crypto exchanges: Streami, the operator of the Gopax exchange, and Pravang. According to The Korea Times, about 100,000 personal records were exposed in total. No theft of cryptocurrency from the exchanges has been reported.

The details

The findings were announced at a second emergency meeting of the Financial Services Commission (FSC), the Financial Supervisory Service and the Financial Security Institute. Regulators first reported seven affected firms; the count is now 16. Besides the exchanges, the list includes Shinhan, KB Kookmin, BNK Busan and Hana banks, several savings banks, Hyundai Capital and KDB Capital, online investment platforms PFCT and Mouda, payment firm Brightfix and the Korean Federation of Community Credit Cooperatives.

The exposed data includes names, contact details, resident registration numbers and email addresses. Regulators found no evidence that account or card numbers, which could be used for direct fraudulent payments, were taken. Authorities did not say how many records came from Gopax or Pravang, or what exactly was taken from them. The number of victims may rise as firms check their systems against attacker IP addresses they share with each other.

Regulators say the attacks were likely driven by AI agents and are not aimed at specific firms; the attackers are probing the whole sector for weak points. An inspection of 555 financial firms found security shortcomings at 130 of them, including missing patches, unsupported systems and no 24-hour monitoring. Large firms will now have to run vulnerability checks at least twice a year instead of once. "It is deeply troubling that financial firms are still failing to meet basic security requirements," FSC Secretary General Shin Jin-chang said.

Gopax is one of Korea's won-based exchanges. In 2023 Binance agreed to buy a controlling stake in its operator Streami; reports on its current holding differ.

What it means for the market

So far this is a personal data leak, not a theft of user funds. The main risk for exchange customers is phishing: with a name, phone number and email, scammers can pose as the exchange and try to extract login codes or seed phrases. Exchanges never ask for those. We are following the story and will collect the details in a separate developing article.

Full timeline — in our explainer.