-
Blogs CryptoCrypto Transfers to Self-Hosted Wallets: What Changes Under Korea’s Travel Rule in 2027?
Transfers from a Korean crypto exchange to a self-hosted wallet (personal wallet) such as MetaMask are not currently treated in the same way as Travel Rule transfers between virtual asset service providers (VASPs). However, following the August 2026 amendment to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information, Korea will strengthen its AML requirements for virtual asset transfers. From February 19, 2027, the KRW 1 million threshold for the Travel Rule will be removed, and transactions involving overseas VASPs and self-hosted wallets will also become subject to separate risk-based AML requirements. For self-hosted wallet transactions, factors such as who actually owns or controls the wallet, whether the sender and recipient are the same person, the purpose of the transaction, and the flow of funds will become increasingly important. Does the Travel Rule Apply to Transfers to Self-Hosted Wallets? A transfer to a self-hosted wallet is not currently treated in the same way as a Travel Rule transfer between VASPs. Under Korea’s current Travel Rule framework, when a VASP transfers virtual assets worth KRW 1 million or more to another VASP, specified information regarding the sender and recipient must be provided. A self-hosted wallet such as MetaMask, however, is controlled directly by the user and is not itself a Korean VASP. Accordingly, withdrawals to self-hosted wallets should be reviewed not only from a Travel Rule perspective but also in light of the exchange’s AML obligations and wallet verification policies. Depending on the exchange, users may already be required to register a wallet address or verify ownership before making a withdrawal. Official Legislation Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information What Will Change for Self-Hosted Wallet Transactions in 2027? From February 19, 2027, virtual asset transfers involving self-hosted wallets will become subject to enhanced risk-based AML controls. The amended Enforcement Decree expands the obligations imposed on VASPs in connection with virtual asset transfers. The Financial Services Commission (FSC) has outlined the following regulatory approach. 🔹 Self-Hosted Wallet and Overseas VASP Transactions from 2027 Transaction Type Expected Regulatory Approach Low-risk overseas VASP Virtual asset transfers generally permitted Other overseas VASPs Generally permitted where the sender and recipient are the same person Self-hosted wallet Generally permitted where the sender and recipient are the same person High-risk transaction Transfer may be restricted or prohibited Transactions of KRW 10 million or more involving overseas VASPs or self-hosted wallets A separate suspicious transaction monitoring framework must be established and operated Accordingly, a withdrawal to a wallet controlled by the customer may be treated differently from a direct withdrawal to a wallet controlled by a third party. However, the detailed risk-assessment standards and implementation methods will need to be reviewed together with the relevant KoFIU regulations and the policies of individual exchanges. Official Source Financial Services Commission – August 11, 2026 What About Deposits from a Self-Hosted Wallet to a Korean Exchange? Deposits from a self-hosted wallet to a Korean exchange may also be subject to review. The amended framework covers transactions in which a VASP transfers virtual assets to, or receives virtual assets from, a self-hosted wallet. Accordingly, when virtual assets are deposited from a self-hosted wallet into a Korean exchange, factors such as the actual wallet owner, the source of funds, and the purpose of the transaction may become important. Where assets are repeatedly deposited from multiple wallets, it is advisable to retain transaction records showing the source and movement of the assets. Can the Travel Rule Be Avoided by Splitting Transfers Below KRW 1 Million? No. Splitting transfers into amounts below KRW 1 million does not place the transactions outside AML scrutiny. The current Travel Rule threshold for VASP-to-VASP transfers is KRW 1 million. From February 19, 2027, this threshold will be removed and the Travel Rule will apply regardless of the transfer amount. Even under the current framework, transactions below KRW 1 million are not automatically excluded from AML monitoring. The FSC has cited a case involving approximately KRW 200 million in virtual assets that was withdrawn through 216 separate transactions below KRW 1 million as an example of activity potentially intended to circumvent regulatory controls. Accordingly, factors such as repeated split transfers, wallet ownership, the source and movement of funds, and the purpose of the transaction may also be reviewed. Frequently Asked Questions (FAQ) Q1. Does the Travel Rule apply when I withdraw crypto to MetaMask? Not in the same manner as a transfer between two registered Korean VASPs under the current framework. However, exchange-specific wallet verification and AML requirements may still apply. From February 19, 2027, self-hosted wallet transactions will also become subject to enhanced risk-based AML controls. Q2. Can I withdraw less than KRW 1 million to a self-hosted wallet without restrictions? A transaction below KRW 1 million is not automatically excluded from AML monitoring. Repeated small withdrawals or transactions involving multiple wallets may still be reviewed based on the overall transaction pattern. In addition, the KRW 1 million Travel Rule threshold between VASPs will be removed from February 19, 2027. Q3. Will transfers to another person’s self-hosted wallet be prohibited? Not necessarily. A blanket prohibition on all transfers to third-party wallets has not been established. However, the Financial Services Commission has indicated that transactions involving self-hosted wallets will generally be permitted where the sender and recipient are the same person. The detailed scope of permitted transactions and exceptions will depend on implementing regulations and individual exchange policies. Q4. Will deposits from a self-hosted wallet to a Korean exchange also be subject to enhanced controls? Yes. The new framework applies not only to withdrawals but also to situations where a VASP receives virtual assets from a self-hosted wallet. The exchange may therefore review wallet ownership, transaction history, source of funds, and the purpose of the transfer. Q5. Does a transaction of KRW 10 million or more automatically trigger a Suspicious Transaction Report (STR)? No. A transaction does not automatically become reportable solely because it exceeds KRW 10 million. The announced framework requires VASPs to establish and operate a separate monitoring system for transactions of KRW 10 million or more involving overseas exchanges or self-hosted wallets. Whether an STR is ultimately required depends on the specific circumstances, including the source of funds, transaction purpose, transaction pattern, and counterparty. Prepare for the New Self-Hosted Wallet Rules Before February 2027 From February 19, 2027, Korea’s Travel Rule will apply to all transfers between VASPs regardless of amount, while risk-based AML controls for transactions involving self-hosted wallets and overseas VASPs will also be strengthened. For self-hosted wallet transactions, actual wallet ownership and control, whether the sender and recipient are the same person, the purpose of the transaction, and the flow of funds may become increasingly important. Businesses that use self-hosted wallets or overseas exchanges for recurring payments, transfers, or settlement should review their transaction structures and applicable regulatory requirements before the new rules take effect. Decent Law Firm advises clients on Korean virtual asset regulations, self-hosted wallet and overseas VASP transactions, Travel Rule compliance, and AML obligations under the Act on Reporting and Using Specified Financial Transaction Information.
2026-08-28 -
Blogs Crypto
Crypto Market Making in Korea: Legal Risks for Token Projects and Market Makers
Crypto market making is not automatically considered market manipulation under Korean law. However, the legal analysis does not stop at whether an agreement is labeled as a “market making” or “liquidity provision” arrangement. The key issue is how the trading strategy is actually structured and executed—particularly whether it is designed to artificially create trading volume, influence prices, or induce other investors to trade. For foreign token projects, foundations, and market makers engaging with Korean exchanges or Korean users, this means that the Market Making Agreement, trading instructions, API logic, token lending structure, and fee arrangements should be reviewed together. What Is Crypto Market Making? Crypto market making generally refers to the continuous placement of buy and sell orders in order to provide liquidity to a trading market. For newly listed or relatively illiquid virtual assets, limited order-book depth may result in wide bid-ask spreads and significant price movements even from relatively small orders. To address this, a token project may provide tokens or capital to a professional market maker, which then places buy and sell orders on one or more exchanges. A typical market making arrangement may include provisions concerning: Target exchanges and trading pairs Bid-ask spreads Liquidity or volume requirements Token lending and return arrangements Trading capital Service fees and performance-based compensation API or algorithmic trading systems The important point is that entering into a Market Making Agreement does not determine the legal characterization of the actual trading activity. What matters is how those contractual terms are implemented in the market. Is Crypto Market Making Legal in Korea? Crypto market making is not unlawful merely because liquidity is being provided to the market. However, actual trading activity may fall within Korea’s prohibition on unfair trading if it is intended to induce other investors to trade or to artificially influence trading volume or prices. Article 10 of Korea’s Act on the Protection of Virtual Asset Users prohibits, among other conduct: Matched orders Wash trades Transactions designed to create a false appearance of active trading Transactions intended to artificially move or stabilize the price of a virtual asset Other fraudulent or deceptive trading practices Accordingly, describing a trading arrangement as “liquidity provision” is not sufficient. The actual analysis may require reviewing: Who determines the trading strategy Whether specific price or volume targets are imposed Whether the token project participates in or directs trading decisions Whether the market maker’s compensation is linked to price or volume performance How orders, cancellations, and executions actually occur The distinction between legitimate liquidity provision and unlawful market manipulation therefore depends heavily on the purpose and structure of the actual trading activity. Act on the Protection of Virtual Asset Users – Article 10 What Market Making Structures May Create Higher Regulatory Risk? Market manipulation risk may increase where a market making arrangement goes beyond providing ordinary liquidity and instead seeks to artificially create a particular level of trading activity or price. 🔹Key Market Making Terms to Review Structure Key Legal Issue Minimum trading volume Whether volume is being artificially generated regardless of genuine market demand Target price Whether trading is intended to push the token toward a specified price Price floor or price band Whether the strategy constitutes ordinary liquidity provision or artificial price stabilization Repeated high-priced purchases Whether orders are intended to induce additional buying by other investors Multiple trading accounts Whether economically identical parties are trading against each other API trading How orders, cancellations, and re-orders are triggered Token lending How the market maker may use or dispose of the tokens and how they must be returned Performance fees Whether compensation is directly tied to price appreciation or increased trading volume A contractual requirement to maintain liquidity or a certain spread does not, by itself, establish unlawful conduct. The analysis may change, however, where the actual strategy involves repeated trades unrelated to genuine market demand, artificial volume generation, or continuous buying designed to defend a specific token price. The contractual KPI and the actual trading strategy should therefore be reviewed together. Can API or Algorithmic Market Making Create Market Manipulation Risk? The use of APIs or automated trading systems does not itself constitute market manipulation. Automated order placement is commonly used in market making because market makers must respond quickly to changing order-book conditions. The legal issue is what type of trading strategy has been automated. Additional review may be required where an automated strategy involves, for example: Repeated high-priced purchases Large orders followed by rapid cancellations Multiple accounts placing coordinated orders Repeated trades designed primarily to generate volume Orders designed to influence prices across multiple exchanges In July 2026, the Korean Financial Services Commission disclosed enforcement cases involving virtual asset market manipulation using high-frequency API trading, high-priced purchases, and manipulative order strategies. The significance of these cases is not that API trading itself is prohibited, but that the purpose, order pattern, and resulting market impact of the trading activity are subject to scrutiny. FSC – Key Results of Virtual Asset Unfair Trading Investigations What Should Be Reviewed in a Market Making Agreement? A Market Making Agreement should be reviewed not only for commercial terms, but also for how those terms may influence actual trading behavior. Trading Volume Requirements Where daily or weekly trading volume targets are imposed, the key issue is not simply the existence of a target. The review should determine how the market maker is expected to achieve the required volume and whether the strategy may result in transactions unrelated to genuine market demand. Price-Related Conditions Terms such as “maintain the price above a certain level,” “defend against price declines,” or “reach a target price” require particular attention. Ordinary spread management and trading intended to artificially maintain or influence a specific market price should not be treated as the same activity. Token Lending and Return Where a project provides a significant number of tokens to the market maker, the agreement should clearly address: Permitted use of the tokens Disposal authority Return obligations Settlement mechanics Allocation of trading profits and losses Performance Fees and Trading Authority Performance-based compensation should also be examined, particularly where fees are linked directly to token price appreciation or trading volume. In addition, even where the written agreement gives the market maker independent trading authority, actual instructions sent through Telegram, Slack, email, or other channels may become relevant if the project is directing specific price or volume outcomes. Is Reviewing the Market Making Agreement Alone Sufficient? No. The agreement and the actual operating structure should be reviewed together. A contract may simply refer to “liquidity enhancement,” “spread maintenance,” or “market making services.” Actual communications or trading instructions, however, may contain materially different expectations concerning price support or volume generation. For this reason, a legal review may need to cover not only the agreement itself but also: Market Making Agreement and side letters Internal operating guidelines and KPIs Exchange order and execution records API logic and trading parameters Trading-account structure Token and fund transfers Telegram, Slack, email, and other trading instructions Fee and performance compensation arrangements The key issue is not only what the contract says, but how the contractual terms are implemented through actual orders and executions. Do Korean Rules Apply to an Offshore Market Maker? Using an offshore market maker does not automatically exclude the application of Korean law. Article 3 of the Act on the Protection of Virtual Asset Users provides for extraterritorial application where conduct outside Korea produces effects within Korea. Accordingly, Korean regulatory exposure should be considered where, for example: Market making is performed on a Korean exchange A token is listed on both Korean and overseas exchanges Trading on an offshore exchange is used to influence the Korean market A Korean project directs an offshore market maker regarding price or volume Korean regulators have also investigated cases involving virtual assets listed simultaneously on Korean and foreign exchanges where trading activity across markets was allegedly used to influence Korean investors. Depending on the exact scope of services, it may also be necessary to consider whether the market maker’s activities raise separate issues under Korea’s virtual asset service provider regulatory framework. Act on the Protection of Virtual Asset Users What Should Be Reviewed Before Entering into a Market Making Arrangement? Before entering into a Market Making Agreement, the project and market maker should align the contractual terms with the anticipated trading structure. 1. Roles and Trading Authority Determine who establishes the trading strategy and who has authority to execute orders. 2. Price and Volume KPIs Review whether spread, liquidity, volume, or price-related KPIs may require problematic trading behavior in practice. 3. Token and Fund Flows Map how tokens and trading capital move from the project to the market maker and ultimately to exchange accounts. 4. Trading Method Determine whether trading will be manual, API-based, or algorithmic, and whether multiple accounts or exchanges will be used. 5. Compensation Structure Assess whether compensation is simply payment for liquidity services or is directly tied to price appreciation or increased trading volume. The relevant contracts, order logs, API records, internal instructions, and token transfer records should also be retained appropriately. These materials may become important if the trading activity is later reviewed by an exchange, regulator, or investigative authority. What Are the Consequences of Market Manipulation in Korea? Market manipulation involving virtual assets may lead to administrative sanctions, criminal liability, and civil damages. The Act on the Protection of Virtual Asset Users provides for monetary penalties in relation to unfair trading conduct and criminal penalties for violations of Article 10. The severity of sanctions may vary depending on factors including the amount of unlawful profit or avoided loss. The Financial Services Commission announced in July 2026 that, during the first two years following implementation of the Act, Korean authorities had completed approximately 40 unfair-trading investigations and referred or reported more than 30 cases to investigative authorities. Accordingly, market making structures should not be reviewed only after an enforcement issue arises. Potential unfair-trading exposure should be assessed at the contract and trading-structure stage. FSC – Key Results and Future Plans for Virtual Asset Unfair Trading Investigations Frequently Asked Questions (FAQ) Q1. Is using a crypto market maker illegal in Korea? No. The use of a market maker does not itself establish market manipulation. The actual trading strategy, purpose, project involvement, and price or volume conditions must be reviewed. Q2. Can a Market Making Agreement require a minimum trading volume? A minimum volume requirement is not automatically unlawful. However, if the target is achieved through transactions intended to create an artificial appearance of active trading, the arrangement may raise unfair-trading concerns. Q3. Can a project ask a market maker to maintain a minimum token price? Price-support or price-floor arrangements require particular caution. Korean law prohibits certain transactions conducted for the purpose of inducing other investors to trade by artificially moving or stabilizing the market price. Q4. Is API-based market making considered market manipulation? No. The use of an API itself is not prohibited. The relevant issue is whether the automated strategy is designed to artificially generate volume, influence prices, or induce other investors to trade. Q5. Does Korean law apply to foreign market makers? It may. Where offshore trading produces effects in Korea, including through Korean exchange markets or Korean investors, the potential application of Korean virtual asset regulations should be reviewed. Market Making in Korea Requires More Than Contract Review The central legal issue in crypto market making is not whether a contract describes the activity as “liquidity provision.” The key questions are how orders are actually generated, what objectives the project gives to the market maker, and what price and trading volume are ultimately created by the strategy. Where price targets, volume KPIs, API trading, token lending, and performance compensation are combined, the legal analysis should cover both the written agreement and the actual operating structure.
2026-08-27 -
Blogs Crypto
Crypto Hacking Response Guide: What to Do First After You Discover a Breach
1. What Should You Check First When You Discover You've Been Hacked? The first thing to determine is exactly how your crypto assets left your control. Even incidents that look like the same "crypto hacking" can involve very different response strategies and liability structures — a compromised exchange account, a leaked wallet seed phrase, and a fraudulent signature approved on a phishing site are not the same problem. So as soon as you confirm the loss, the first step is to identify which type of incident you are dealing with. Type of Incident What to Check First Immediate Response Exchange account compromised Login history, withdrawal history, whether 2FA settings were changed Request an account/withdrawal freeze Personal wallet compromised Whether the seed phrase or private key was exposed Consider moving remaining assets to a new, secure wallet Phishing site interaction The URL visited, and any signatures or token approvals granted Block further approvals/access and preserve evidence Malware/remote access Installed programs, access and execution logs Stop using the infected device and preserve evidence Exchange-side breach The exchange's incident notice, affected assets, and scope of damage Check the exchange's notice and claims procedure Identifying the type of incident first makes it much easier to determine what evidence to gather and who may ultimately be liable. In particular, if the loss occurred while using an exchange, it is worth checking not only how well you managed your own account, but also whether the exchange was properly safeguarding user assets. Under Article 7 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to keep their own assets separate from user assets and to actually hold the same type and quantity of virtual assets entrusted to them by users. In addition, the current Regulation on Supervision of Virtual Asset Business requires at least 80% of the economic value of user assets to be kept in an environment separated from the internet (cold storage). So if the breach occurred at an exchange, rather than concluding simply that "the account was hacked," it is important to work out exactly how authentication was carried out and which account or wallet the withdrawal came from, since this will affect how liability is ultimately determined. 2. What Should You Do Immediately to Stop Further Losses? Once you confirm the breach, the first priority is to stop any remaining crypto assets from being drained further. If the breach occurred on an exchange account, the first step is to contact the exchange's customer support or incident report channel to check whether login or withdrawals can be restricted. At this stage, don't stop at simply changing your exchange password — check whether other authentication methods, such as your email, phone number, or OTP, may also have been compromised. If the issue originated in a personal wallet, the seed phrase or private key itself may already be exposed. In that case, rather than continuing to use the same wallet, you should consider creating a new wallet in a verified, secure environment and moving any remaining assets there. That said, be careful about immediately resetting a compromised phone or computer. The device may still hold records — phishing site visit history, malware, login logs — that show exactly how the account or wallet was compromised. What to Check Immediately After a Crypto Hacking Incident Request a freeze on further withdrawals from the exchange account Check whether your password, OTP, or other authentication methods were compromised Review protective measures for any remaining crypto assets Avoid resetting the affected device without careful thought Preserve withdrawal alert emails, texts, and app notifications Save your exchange customer support inquiries and their responses What matters at this stage is not rushing into every possible action, but balancing preventing further damage with preserving evidence. At Decent Law Firm, in the initial consultation we first identify the structure of the incident — whether it involves a compromised exchange account, a compromised personal wallet, or phishing/remote access — and based on that, help determine what evidence should be preserved first and what should be requested from the exchange. 3. What Evidence Should You Secure After a Crypto Hacking Incident? Once you've stopped further losses, the next step is to gather as much evidence as possible showing how the stolen assets moved. In crypto cases, what matters most is not just a screenshot of the loss, but the transaction records showing exactly when the assets moved, from which address to which address. Where possible, try to preserve the following information in as close to its original form as possible. Evidence You Should Secure Date and time of the incident Type and quantity of the stolen crypto assets Value of the assets in Korean won at the time of the loss The withdrawal (sending) wallet address The receiving wallet address The TXID or transaction hash The exchange or wallet service used Login and access notifications OTP, phone, and email authentication records Password change notifications Records of exchange customer support inquiries The phishing site URL Related text messages, emails, and messenger conversations Information on any suspicious programs or apps Of these, the TXID and wallet addresses are the core evidence for tracing how the assets moved afterward. On public blockchains, a block explorer can be used to trace how assets moved from the initially compromised address to other addresses. Records kept internally by the exchange also matter. Under Article 9 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to retain transaction records — sufficient to trace, search, and verify transactions — for 15 years from the end of the transactional relationship. However, the fact that an operator retains transaction records is a separate question from whether a victim can immediately obtain all of the internal data they want. Login IP addresses, authentication data, withdrawal approval processes, and other internal system records may not be voluntarily disclosed by the exchange, and may need to be obtained through the proper legal process during an investigation. So before filing a report, it helps to separate what you can gather yourself now from what will need to be obtained later through the investigating authorities. At Decent Law Firm, based on the transaction history, TXIDs, wallet addresses, and exchange responses a victim has secured, we organize a chronological timeline of how the assets moved from the moment of the loss, and structure the facts and evidence so they can be used effectively in a police report or criminal complaint. 4. Can Crypto Assets Already Moved to Another Wallet Still Be Traced or Frozen? Even after crypto assets have moved to another wallet, it is sometimes still possible to trace the transaction path on the blockchain. However, being traceable and being actually recoverable are two different questions. On public blockchains, the transfer from the originally compromised wallet to another wallet remains on the record. So it is possible to check where the stolen assets moved afterward, and whether they show signs of having flowed into a domestic or overseas centralized exchange. In particular, if the assets are confirmed to have moved into a deposit address at an identity-verified centralized exchange, the account information and transaction records held by that exchange can become important evidence for an investigation. Factors to Check When Assessing Recovery Potential Factor What It Means Current custody wallet Whether the stolen assets still remain at that address Inflow to a centralized exchange Whether identity verification may be possible through an exchange account Further movement of assets Whether the assets were quickly split across multiple addresses Change of chain Whether the assets were moved to another network via a bridge Asset conversion Whether the assets were converted into a different crypto asset Use of an overseas operator Whether cooperation from a foreign exchange or international cooperation is needed That said, confirming that assets moved on the blockchain does not mean those assets can be immediately frozen. Reporting and freezing procedures differ from exchange to exchange, and actually freezing assets or obtaining account information may require legal process, such as a request from investigating authorities or a warrant. In addition, if assets have been split across multiple wallets, moved to a different chain, or converted into a different crypto asset, tracing and recovery become considerably more complex. So you should not assume either that "there is a blockchain record, so recovery is guaranteed" or, conversely, that "the assets already moved to another wallet, so recovery is impossible." At Decent Law Firm, based on the secured TXIDs and wallet addresses, we map out how the assets moved, and where there are signs that assets flowed into a specific exchange, we organize the material so that fact is clearly communicated to the investigating authorities. Where an overseas exchange is involved, we also consider that exchange's own damage-reporting and evidence-preservation procedures, along with whether international cooperation through Korean investigating authorities is needed. 5. What Is the Right Order for Filing a Police Report and Seeking Recovery? Once you have organized the facts of the loss and the basic transaction data, the next step is to consider filing a report with the investigating authorities. You can report hacking and other cybercrime damage through the Korean National Police Agency's Cybercrime Reporting System (ECRM), which asks you to specify the date and details of the loss and describe how the crime occurred. In crypto cases, rather than simply stating "my coins were hacked," it is important to organize and submit materials that let investigators immediately understand the structure of the incident. What to Organize Before Filing a Report 1) How the Incident Occurred Note the last time you used the account normally, and when you first noticed the unusual withdrawal. 2) The Assets Affected Summarize the type and quantity of crypto assets involved, and the total loss. 3) The Fraudulent Transaction Confirm the TXID and the sending/receiving wallet addresses. 4) Signs of Account Compromise Note any confirmed signs such as foreign IP access, password changes, OTP changes, or a compromised email account. 5) Movement of the Assets After the Theft If you can confirm the assets moved to another wallet or exchange, include that information as well. Organizing this information in advance helps investigators determine which exchange or business operator to seek records from, and what specifically to request. At Decent Law Firm, after organizing the facts of the incident and the asset movement history, we help specify the exchange accounts, access logs, authentication records, and wallet addresses that investigators will need to confirm during a criminal complaint or report. Even after an investigation begins, if new wallet addresses or signs of exchange inflow are identified, they should be organized as additional evidence and submitted. 6. Frequently Asked Questions (FAQ) Q1. My coins were moved to another wallet through hacking — can the transaction be reversed? Once a transfer is recorded on the blockchain, it is generally very difficult to reverse it the way you might cancel a bank transfer. So rather than trying to cancel the transaction itself, it is more important to identify the current location of the stolen assets and their transaction path, and check whether they have since flowed into an exchange. Q2. If the stolen coins moved to an overseas exchange, does that mean recovery is impossible? The mere fact that the assets moved to an overseas exchange does not mean recovery is impossible. That said, the required procedure and its difficulty can vary depending on the exchange's home country and policies, whether it holds user identity information, the current status of the assets, and the likelihood of cooperation with Korean investigating authorities. Q3. Should I immediately reset a phone or computer that was hacked? Taking steps to prevent further damage is necessary, but resetting the device unconditionally before all the case evidence has been secured requires caution. The affected device may still contain access logs, phishing URLs, malware, and other data showing how the breach occurred, so it is worth preserving the necessary evidence first before proceeding with safety measures. 7. Summary and Key Points If you experience a crypto hacking incident, the first priority is to stop any further withdrawals and secure evidence — TXIDs, wallet addresses, login and authentication records — that can help establish what happened. If the crypto assets have already moved to an external wallet, you should trace the path from the original fraudulent transaction onward, and where there are signs the assets flowed into a specific exchange, consider pursuing evidence preservation and a potential freeze through the investigating authorities. If the cause of the loss appears related to the exchange's own authentication or custody systems, it is also worth examining the exchange's legal obligations and the possibility of a damages claim. At Decent Law Firm, we review the transaction history, TXIDs, wallet addresses, and exchange usage records to reconstruct how the incident occurred and how the assets moved, and help build out the facts and evidence needed for a police report or criminal complaint. Where the stolen assets show signs of moving through domestic or overseas exchanges, we also look at the possibility of requesting evidence preservation or a freeze from the exchange, along with further steps through the investigating authorities, and where the incident relates to the exchange's security or custody obligations, we consider the full path toward recovery, including a damages claim. Because crypto assets can move through multiple wallets and exchanges in a very short time, once you confirm a loss, the priority is to organize whatever evidence you can secure right now, and to get help from a professional as soon as possible so you have the best chance of recovering your lost funds.
2026-08-25 Naver Blog -
Blogs Crypto
Crypto Market Manipulation in Korea: Penalties and Legal Standards for Spoofing and High-Priced Buy Orders
A sharp increase in a cryptocurrency’s price or a large volume of trades by a single trader does not, by itself, constitute market manipulation under Korean law. The key issue is whether the trader intentionally created artificial trading volume or price movements in order to induce other investors to trade. Korea’s Act on the Protection of Virtual Asset Users prohibits matched orders and wash trades, as well as transactions intended to make the market appear more active than it actually is or to artificially move or stabilize the price of a virtual asset. Accordingly, even where high-priced buy orders, spoofing, multiple accounts, or API-based automated orders are identified, the legal analysis should not focus on a single type of order alone. The overall trading pattern—including the purpose of the trades, order and execution history, pre-existing holdings, and subsequent sales—must be reviewed as a whole. Legal Standards for Crypto Market Manipulation in Korea Article 10 of the Act on the Protection of Virtual Asset Users prohibits transactions such as matched orders and wash trades when conducted for the purpose of misleading others into believing that trading is more active than it actually is or otherwise causing investors to make incorrect judgments. The Act also prohibits transactions intended to induce others to trade by creating the appearance of active trading or by artificially moving or fixing the price of a virtual asset. Act on the Protection of Virtual Asset Users, Article 10 Therefore, the focus is not simply on whether trading volume was large or whether the price moved significantly. What matters is why the orders were placed, whether there was a genuine intention to execute them, and whether multiple orders formed part of a coordinated trading strategy. How Are Spoofing and High-Priced Buy Orders Assessed? The presence of high-priced buy orders or spoofing does not automatically establish market manipulation. However, market manipulation may become an issue where such trading patterns are repeated and are accompanied by the disposal of previously accumulated holdings after the price rises. Type of Trading Key Points to Review High-priced buy orders Whether repeated buy orders were used to push the market price upward Spoofing Whether large orders were repeatedly placed and cancelled without a genuine intention to execute Matched orders Whether the parties agreed in advance on the price, quantity, or timing of the trades Wash trades Whether trading volume was created without any meaningful transfer of economic ownership Multiple-account trading Whether multiple accounts traded in coordinated or repetitive patterns API-based trading Whether automated orders were used to artificially create trading volume or price movements In particular, if the trading structure follows a pattern such as accumulation → price formation → disposal of holdings → realization of profits, authorities may review the entire series of transactions rather than treating each order in isolation. What Is the Difference Between Ordinary Trading and Market Manipulation? Buying cryptocurrency before a price increase and selling it later at a profit does not, by itself, amount to market manipulation. When determining whether trading crossed the line into unlawful market manipulation, the following factors may be considered: whether a large position was accumulated before the price increase; whether high-priced or unusually large orders were repeatedly placed; whether orders were repeatedly cancelled after being submitted; whether multiple accounts or API-based systems traded in a coordinated manner; whether substantial holdings were sold immediately after the price increased; and whether communications with other traders or the underlying trading strategy were connected to the actual order pattern. Ultimately, the key question is whether the trader intended to induce other investors to trade by artificially influencing the market price or trading volume, and whether the trading records support that conclusion. What Are the Penalties for Crypto Market Manipulation in Korea? Under Article 19 of the Act on the Protection of Virtual Asset Users, a person who engages in prohibited market manipulation may be subject, in principle, to imprisonment for at least one year or a fine equal to three to five times the profit gained or loss avoided through the violation. 🔹Penalties Based on the Amount of Profit or Loss Avoided Profit Gained or Loss Avoided Statutory Penalty Less than KRW 500 million In principle, imprisonment for at least one year or a fine equal to 3–5 times the profit gained or loss avoided KRW 500 million or more but less than KRW 5 billion Imprisonment for at least 3 years KRW 5 billion or more Life imprisonment or imprisonment for at least 5 years Where imprisonment is imposed, the court may also impose disqualification for up to ten years and a fine. Act on the Protection of Virtual Asset Users, Article 19 In addition to criminal penalties, market manipulation may also result in administrative monetary penalties under Article 17 of the Act. Assets obtained through the unlawful conduct may also be subject to confiscation or collection of equivalent value. Act on the Protection of Virtual Asset Users, Article 17 What Should You Do If You Are Investigated for Market Manipulation? If you are contacted by Korean financial regulators or investigative authorities, it is important to review the entire trading structure during the relevant period, rather than attempting to explain only the particular orders identified by the authorities. Key materials may include: complete buy and sell records for each exchange; order placement, cancellation, and execution history; virtual asset holdings before and after the relevant period; exchanges and accounts used for trading; API logs and automated trading program records; use of accounts or API keys belonging to other persons; communications with other traders; and the source of trading funds and the ultimate recipient of any profits. In market manipulation investigations, objective trading records such as order and execution data can become central evidence. Before responding to investigators, it is therefore important to confirm whether your explanation is consistent with the actual trading records and to prepare a clear, evidence-based explanation of why the orders were placed and what the underlying trading strategy was. Frequently Asked Questions (FAQ) Q1. Can a Single High-Priced Buy Order Constitute Market Manipulation? Not necessarily. A single high-priced buy order does not automatically amount to market manipulation. The purpose of the order, whether similar orders were repeated, market conditions at the time, the size of the trade, and any subsequent sale of the trader’s holdings may all be relevant. Q2. Can I Be Punished Even If I Did Not Make a Profit? Yes. The law prohibits the market manipulation itself, so the absence of actual profit does not necessarily eliminate criminal or regulatory liability. Q3. Is API-Based or Automated Crypto Trading Illegal in Korea? No. The use of APIs or automated trading systems is not illegal in itself. However, if such systems are used to repeatedly place artificial orders, engage in matched trading, or create misleading trading volume or price movements, the conduct may be investigated as market manipulation. Q4. Can Investors Who Suffered Losses Claim Damages? Potentially, yes. However, the existence and scope of civil liability will depend on issues such as causation between the manipulative conduct and the investor’s loss, as well as the timing and price of the relevant transactions. Market Manipulation Investigations Require a Trading-Record-Based Response A sharp increase in a crypto asset’s price or a large trading volume does not automatically establish market manipulation. The central issue is whether trading volume or price movements were artificially created for the purpose of inducing other investors to trade. If you have been contacted by Korean financial regulators, police, or prosecutors, you should first organize your order and execution history, API records, account relationships, and fund flows, and prepare to explain the purpose of the trades based on objective evidence. Decent Law Firm can review your trading records and develop a tailored strategy for responding to a crypto market manipulation investigation in Korea.
2026-08-24 -
Blogs Crypto
Stock Signal Group Fraud in Korea: A Guide From Reporting to Recovering Your Losses
1. When Can Losses From a Stock Signal Group Be Considered Fraud? If the operator of a stock "signal group" deceived investors with lies or fabricated materials to make them hand over money, this may constitute fraud. Article 347 of Korea's Criminal Act punishes deceiving a person to obtain property or a property-related benefit as fraud. The current statutory penalty for fraud is imprisonment for up to 20 years or a fine of up to KRW 50 million. This penalty was increased by an amendment that took effect on December 23, 2025. What matters, however, is not simply that the investment result was poor, but whether there was deception in the process that led the victim to pay money. For example, the following circumstances warrant a closer look at the underlying facts. Claiming to represent an expert or company that does not actually exist Presenting fabricated account returns or trading records Promising to guarantee the principal or a fixed return despite the possibility of loss Receiving money in the name of investment funds without actually investing it Demanding additional deposits under pretexts such as taxes, security deposits, or fees when withdrawal is requested Giving an explanation about the use of the funds or the transaction structure that differs from the truth In particular, if a person received investment funds while having no intention or ability from the outset to provide a legitimate investment service, whether fraud is established can be examined more actively. If the amount gained through the crime is KRW 500 million or more, aggravated punishment under the Act on the Aggravated Punishment of Specific Economic Crimes may also be examined. However, how to calculate the damages of multiple victims can vary depending on the structure of the offense and the relationships among co-offenders. 2. Does Every Investment Loss in Stocks Mean Fraud? No. The mere fact that a loss occurred due to normal market fluctuations during an otherwise legitimate investment does not establish fraud. Because stock prices inherently carry the possibility of fluctuation, it is difficult to punish an operator for fraud simply because a recommended stock fell in price or an expected return was not achieved. Therefore, in the investigation process, what explanation the investor received before paying money or purchasing stock is generally the key point of review. Key checkpoints for distinguishing fraud from a simple loss Category What to check Evidence worth securing Likely a simple investment loss Stock was actually purchased normally, and the loss occurred from market fluctuation Securities account transaction history, recommendation messages False representation of returns Fake profit verification or manipulated account screens presented Advertisement screenshots, profit-verification images Guarantee of principal or profit Explanation that "there is no loss" or "the return is guaranteed" KakaoTalk/Telegram conversations, recordings Inducement of additional deposits Additional remittances demanded citing withdrawal, taxes, deposits, etc. Remittance records, withdrawal-request conversations False use of investment funds Money was said to be invested but was actually used for other purposes Account transfer records, contracts Individualized investment instructions Specific stocks, prices, and buy/sell timing continuously instructed for the individual 1:1 consultation records, paid chat room conversations Ultimately, what matters more than the size of the loss is whether the explanation that led to the investment decision was true. In particular, if you were told things such as "insider information available only to VIPs," "a stock confirmed to list soon," or "the company guarantees the principal," you should check whether there was any actual basis for such claims. 3. Even If It Is Not Fraud, Could It Violate the Capital Markets Act? Yes. Depending on how the stock signal group is operated, a violation of the Capital Markets Act may be at issue separately from fraud. The Financial Investment Services and Capital Markets Act currently defines as a "quasi-investment advisory business" the business of providing, for consideration from customers, non-individualized advice on investment judgments or the value of financial investment products through publications, broadcasts, or other communication media. On the other hand, if advice on investment judgment is provided individually, reflecting an investor's financial situation or investment objectives, this may fall under the "investment advisory business." In connection with a system implemented from August 14, 2024, Korea's Financial Services Commission has announced that providing investment advice to paying members through two-way channels such as SNS or open chat rooms may be subject to regulation as an investment advisory business. Operating an investment advisory business without registration may raise issues of imprisonment for up to 3 years or a fine of up to KRW 100 million under Articles 17 and 445 of the Capital Markets Act. In addition, Article 101-2 of the Capital Markets Act currently prohibits quasi-investment advisory businesses from the following types of advertising. Advertising that could be mistaken for that of a financial company Advertising that could be mistaken as guaranteeing against loss or guaranteeing profit Advertising presenting a rate of return that is false or has not actually been realized This is a currently effective regulation. Therefore, the mere fact that an operator reported itself to the financial authorities as a quasi-investment advisory business does not mean that all of its business practices are automatically lawful. 4. If I File a Criminal Complaint, Can I Get My Money Back? Filing a criminal complaint alone does not automatically result in the return of the money you lost. Criminal procedure is a process for determining whether the offender's crime is established and for imposing punishment. Therefore, even if the investigative agency recognizes the fraud charge, if the offender has no assets, there may be real difficulty in recovering the lost funds. To recover the lost funds, the following methods can be considered together with the criminal procedure. ① Civil claim for damages Under Article 750 of the Civil Act, a person can claim damages from someone who caused harm through an intentional or negligent unlawful act. ② Provisional attachment If you have identified specific assets of the offender, such as a bank account or real estate, a provisional attachment before filing the main lawsuit can be considered. Article 276 of the Civil Execution Act recognizes provisional attachment as a way to preserve future compulsory execution of monetary claims and the like. However, obtaining a provisional attachment requires substantiating the underlying claim and the necessity of preservation. ③ Order for restitution at the criminal trial stage If a fraud case is prosecuted, filing for an order for restitution during the criminal trial can also be considered. Once an order for restitution is finalized, the certified copy of the guilty judgment may carry the same effect as a certified copy of a civil judgment with executory force for purposes of compulsory execution. However, if the amount of damages or the scope of liability is unclear, the court may dismiss the application for restitution. Recovering the lost funds therefore requires looking not only at whether to file a complaint, but also at the offender's personal details and assets, the remittance route, and the stage of the criminal case. 5. What Should I Prepare Before Reporting a Stock Signal Group Scam? The first thing to do is to secure the relevant materials before leaving the signal group chat room or deleting the conversation. Stock signal group cases often involve advertising, consultation, and deposits all taking place online, so posts may be deleted or the operator may switch accounts as time passes. It is advisable to organize the following materials in their original form as much as possible. 1) Keep the entire chat history of the signal group Rather than picking out only the stock recommendation messages from KakaoTalk, Telegram, or text messages, secure the entire flow from the inducement to join through the request for investment and withdrawal. 2) Capture the advertisements and return-rate materials Keep the advertisements you saw when you joined, such as promises of a guaranteed principal, guaranteed returns, expert credentials, and successful investment cases. 3) Organize the deposit and transaction records Organize, in chronological order, who you sent money to, which account it went to, and how much. If you actually purchased stock through a securities account, prepare that transaction history as well. 4) Secure information about the operator and the business Secure the trade name, the representative's name, the phone number, the account holder's name, the website address, the business registration number, and any SNS accounts used. 5) Write out the timeline of the harm Organizing the sequence of events — the date you first saw the advertisement → joining → the explanation given → the initial deposit → additional deposits → the demand for withdrawal → loss of contact — helps you explain the facts of the complaint more clearly. 6) Keep other victims' materials separate from your own account of the facts Even where other victims of the same signal group are identified, the amount deposited and the explanations given may differ from victim to victim. You should keep what you personally experienced separate from other victims' materials. If you realized you had been victimized right after sending money, it is advisable to contact your financial institution and the investigative agency promptly to check whether any action can be taken on that transaction. However, an immediate account freeze is not possible in every stock signal group case, so the specific remittance method and type of crime involved should be checked separately. 6. Frequently Asked Questions (FAQ) Q1. The stock signal group said the principal was guaranteed, but I incurred a loss. Is that automatically fraud? A promise to guarantee the principal can be an important piece of evidence, but that alone does not conclusively establish fraud. It is necessary to comprehensively check whether there was actually an intention and ability to cover the loss at the time of the promise, whether false returns or false information were presented along with it, and whether the investor paid money in reliance on that explanation. Because the Capital Markets Act also regulates loss compensation and profit guarantees by quasi-investment advisory businesses, an issue under the Capital Markets Act can be examined separately from criminal fraud. Q2. If the investment advisory firm is unregistered, is the contract automatically void and can I get a full refund? The mere fact that a firm is unregistered does not mean the entire contract automatically becomes void. Korea's Supreme Court has held that a violation of the prohibition on operating an unregistered investment advisory business under Article 17 of the Capital Markets Act does not, by itself, mean that the private-law effect of the investment advisory contract is immediately negated. Q3. If the signal group has already been deleted and I cannot reach the operator, is it difficult to report? The fact that some materials have disappeared does not mean that reporting itself is impossible. You should first secure whatever materials remain, such as account transfer records, text messages, existing screenshots, card payment records, and the other party's phone number and account holder's name. In particular, since the account holder and the actual signal group operator may be different people, it is important to organize the flow of funds and the role of each party involved. 7. Summary and Points to Note The mere fact that a loss occurred in a stock signal group does not by itself establish fraud. Whether there was a false explanation at the time of joining or investing, whether money was paid in reliance on that explanation, and how the operator actually used the funds are the key factors for judgment. If you suspect you have been victimized, rather than simply contacting the operator repeatedly, you should first preserve the chat history, advertising materials, remittance records, and a timeline of what happened. Decent Law Firm reviews the circumstances of joining, the process of inducement to invest, the flow of funds, and the operator's explanatory materials in stock signal group cases to identify the applicable issues, such as fraud and violations of the Capital Markets Act. In addition to filing a criminal complaint, when the other party's assets can be identified, we review procedures for recovering the lost funds — such as provisional attachment, a civil claim for damages, and an order for restitution — and guide clients toward a response strategy suited to the stage of their case.
2026-08-18 Naver Blog -
Blogs Crypto
Korea VASP Major Shareholder Changes: 30-Day Prior Reporting Requirement
Foreign investors acquiring shares in a Korean virtual asset service provider (“VASP”) should now consider regulatory reporting requirements before determining the closing date of the transaction. Under the amendments to Korea’s Specified Financial Transaction Information Act, effective August 20, 2026, major shareholders become subject to expanded reporting and screening requirements. Changes relating to major shareholders will also shift from post-change reporting to a prior report generally required 30 days before the change. 1. Who Qualifies as a Major Shareholder of a Korean VASP? A major shareholder is not determined solely by a shareholder’s ownership percentage. Under the amended Act, major shareholders include the largest shareholder and principal shareholders. A principal shareholder may include a person who: owns at least 10% of the VASP’s voting shares; alone or together with others appoints the representative director or a majority of directors; or exercises substantial influence over major management decisions or business operations. Certain shareholders who are related parties of the largest shareholder may also fall within the reporting scope. Where the largest shareholder is a corporation, persons further up the ownership chain, including certain controlling persons and representatives of that corporate shareholder, may also need to be identified. 2. When Is a Major Shareholder Change Report Required? From August 20, 2026, changes involving a VASP’s major shareholders are subject to prior reporting, generally 30 days before the proposed change. Previously, relevant changes were generally reported after the event within the applicable reporting period. Under the revised framework, major shareholder changes and changes to the VASP’s compliance framework are treated as prior-reporting matters. This means that a share acquisition or investment should be reviewed not only from a contractual perspective but also based on: the proposed signing date; the filing date; the anticipated regulatory review period; the closing date; and the date on which the actual ownership or control change occurs. A transaction timetable that does not account for the reporting process may create regulatory risk. 3. What Types of Transactions May Trigger a Major Shareholder Review? A major shareholder change should be considered where a transaction changes the VASP’s ownership or control structure. Examples include: an investor acquiring 10% or more of the voting shares; a share purchase resulting in a new largest shareholder; changes among existing shareholders that alter the largest shareholder; an acquisition of rights that gives an investor substantial influence over management; and a change in the upstream ownership structure of a corporate major shareholder. Accordingly, an investment below 10% does not automatically fall outside the scope of review. Governance rights, director appointment rights, shareholder agreements and other arrangements affecting actual control should also be considered. 4. What Will Be Reviewed in Relation to a Major Shareholder? The amended framework expands regulatory review to include a major shareholder’s legal compliance history, financial condition and social creditworthiness. The filing may require information concerning the major shareholder’s: identity and nationality; shareholding and ownership interests; relationship with the largest shareholder and related parties; relevant legal violation or criminal history; financial condition; and matters relevant to social creditworthiness. The scope of laws considered in the screening process has also been expanded to cover additional economic crime and virtual asset-related legislation, including corresponding foreign laws in certain cases. For foreign investors, this means that regulatory due diligence may need to extend beyond the Korean VASP itself. 5. What If the Largest Shareholder Is a Foreign Corporation? The analysis may extend beyond the entity directly holding the shares of the Korean VASP. Where the largest shareholder is a corporation, certain persons exercising substantial influence over that corporation, as well as its representative and other persons prescribed by law, may fall within the reporting scope. The Korean Financial Services Commission has also noted that where ownership extends through multiple corporate entities or where a major shareholder is located overseas, obtaining the required documentation may take considerable time. Foreign investors should therefore identify the relevant upstream ownership and control structure before setting a fixed transaction closing date. 6. Do Existing Korean VASPs Need to Take Action? Yes. Existing registered VASPs should also review their shareholder and control structures under the amended regime. The transitional provisions require VASPs that were already registered when the amended Act takes effect to file under the revised Article 7 requirements within three months from the effective date. Existing VASPs should therefore review: their current largest shareholder; shareholders holding 10% or more of voting shares; related-party holdings; shareholders exercising substantial management influence; and relevant upstream ownership where the largest shareholder is a corporate entity. 7. What Happens If the Prior Reporting Requirement Is Not Followed? A major shareholder change should not be treated as a routine post-closing filing. The FSC has specifically cautioned that implementing a change subject to prior reporting before receiving notice that the report has been accepted may constitute a violation and may result in criminal or administrative sanctions. Failure to submit a required change report, or submitting a false or otherwise improper change report, may also result in criminal penalties under the Act. For this reason, the regulatory filing and acceptance process should be incorporated into the transaction structure before closing. 8. What Should Foreign Investors Check Before Investing in a Korean VASP? Before acquiring shares or control of a Korean VASP, the parties should review the following matters: post-transaction voting ownership; whether related-party holdings need to be aggregated; whether the investor will become the largest or a principal shareholder; director appointment and other governance rights; the ownership structure above any corporate shareholder; major shareholder screening issues; documents required from overseas shareholders; and the relationship between regulatory filing and transaction closing. Where a prior report is required, the transaction documents should also address whether acceptance of the regulatory filing will be a condition precedent to closing, the parties’ cooperation obligations and the consequences of delay or non-acceptance. 9. Frequently Asked Questions Q1. Does an investor holding less than 10% fall outside the major shareholder rules? Not necessarily. Even below the 10% threshold, a shareholder may fall within the scope of a principal shareholder if it exercises substantial influence over major management decisions or business operations. Q2. Can the parties sign a share purchase agreement before filing the major shareholder change report? Signing and the actual change in ownership or control should be distinguished. The key issue is that a change subject to prior reporting should not be implemented before the required reporting and acceptance process is completed. For this reason, the regulatory process should be reflected in the closing conditions and transaction timetable. Q3. Are overseas corporate shareholders also subject to review? Yes. Where the largest shareholder is a foreign corporation, the analysis may extend to its upstream ownership and controlling persons. Relevant corporate and ownership documents should therefore be prepared in advance. 10. Key Takeaways Effective August 20, 2026, changes relating to a Korean VASP’s major shareholders are generally subject to a 30-day prior reporting requirement. The analysis is not limited to a 10% ownership threshold. Changes involving the largest shareholder, substantial management influence or an upstream corporate ownership structure may also require review. Foreign investors considering an investment, share acquisition or M&A transaction involving a Korean VASP should therefore assess the major shareholder status, reporting requirements and transaction timeline before closing.
2026-08-18 -
Blogs Crypto
When Does Crypto Trading Violate Korea's Specified Financial Transaction Information Act? Standards and Penalties Explained
Trading virtual assets frequently, or trading large amounts, does not by itself mean that someone has violated Korea's Specified Financial Transaction Information Act (특금법). What matters most is whether a person carried out virtual asset buying, selling, exchanging, transferring, storing, or brokering as a business for other people — and whether that person, as a Virtual Asset Service Provider (VASP), failed to file the required report with Korea's Financial Intelligence Unit (FIU). The Supreme Court of Korea has held that whether someone qualifies as a VASP must be judged comprehensively, taking into account the purpose and type of the transactions, their scale and frequency, the period and method of trading, and other relevant circumstances. Table of Contents What Is a Violation of the Specified Financial Transaction Information Act? Which Types of Violations Arise in Virtual Asset Trading? How Is Personal Coin Trading Distinguished From Operating a Virtual Asset Business? Can OTC, P2P, or USDT Trading Also Violate the Act? What Are the Penalties for Violating the Act? What Should You Check If You Are Being Investigated for a Suspected Violation? Frequently Asked Questions Summary and Points to Note 1. What Is a Violation of the Specified Financial Transaction Information Act? A violation of the Act refers to a breach of the reporting, notification, or customer due diligence obligations set out in the Act on Reporting and Using Specified Financial Transaction Information (특정 금융거래정보의 보고 및 이용 등에 관한 법률). The Act imposes certain obligations on financial companies and Virtual Asset Service Providers (VASPs) in order to prevent money laundering and the financing of illegal activities. In the virtual asset sector, the issue that most commonly arises for individuals and unregistered operators is operating a virtual asset trading business — while qualifying as a VASP — without filing the required report with the FIU. Accordingly, what matters is not simply the fact that coins were traded, but rather for whose benefit and through what structure the trading was carried out, and whether it was conducted continuously and repeatedly as a business. [Related Legislation] Act on Reporting and Using Specified Financial Transaction Information — Korea Law Information Center 2. Which Types of Violations Arise in Virtual Asset Trading? In the virtual asset sector, issues can arise not only from operating without registration, but also from failing to file required notifications or changes of registration, and from breaching anti-money laundering obligations. These can generally be divided into the following categories. Unregistered virtual asset business This refers to operating a virtual asset trading business — while qualifying as a VASP — without filing the required report with the FIU. Depending on the actual structure of the trades, even individual-to-individual OTC or P2P transactions may be found to constitute an unregistered virtual asset business. Failure to file required notifications or changes of registration Even a VASP that has already filed a report must file a notification of change, following the procedure set out in the Act, whenever the details of its original filing change. In particular, from August 20, 2026, the amended Act and its subordinate regulations take effect, tightening VASP registration requirements. Under the amended system, the scope of screening expands to cover the legal violation history, financial status, and social credibility of controlling shareholders, and a VASP's organizational structure, personnel, IT systems, and internal control system also become substantive elements of the registration review. In addition, notifications relating to controlling shareholders and the compliance system will shift from after-the-fact filing within 14 days of the change to advance filing 30 days before the change takes place. If a matter subject to advance filing is carried out before it has been accepted by the authorities, criminal penalties or administrative sanctions may follow — so VASPs planning changes to their governance structure or compliance system should check the filing timeline well in advance. [Related Source] Financial Services Commission & Korea Financial Intelligence Unit, "Comprehensive Revision of the VASP Registration Manual in Line With Strengthened VASP Registration Requirements" (Aug. 13, 2026) 3. How Is Personal Coin Trading Distinguished From Operating a Virtual Asset Business? Whether someone qualifies as a VASP is not determined by transaction amount or frequency alone. The Supreme Court has held that the following factors must be considered together: The purpose and type of the transactions The scale and frequency of the transactions The period over which the trading continued The specific method of trading Whether the trading was carried out for another person's benefit Whether consideration was received for the trading The Court found that an ordinary user who buys, sells, or exchanges virtual assets on an exchange solely for their own benefit and on their own account is, absent special circumstances, unlikely to be treated as a VASP. On the other hand, a person who continuously and repeatedly trades virtual assets for an indefinite number of customers or users, and receives consideration for doing so, may in principle qualify as a VASP. Criteria for distinguishing personal trading from a virtual asset business Category Personal Virtual Asset Trading Trading Likely to Be Treated as a Virtual Asset Business Purpose of trading Personal investment or asset management Providing trading convenience to another person Counterparty Self-directed trading through an exchange Customers or an indefinite number of users Source of funds Mainly the trader's own funds Involvement of customer or third-party funds Profit Capital gains from investment Fees, spreads, or other trading consideration Method of trading Based on the trader's own judgment At another party's request Continuity Depends on investment circumstances Continuous and repeated in a set manner A large trading volume does not, on its own, make trading a virtual asset business if it was conducted with the trader's own funds. Conversely, even a relatively small trading volume may require a review of VASP registration obligations, if the trader repeatedly bought and sold coins at the request of multiple people and received consideration for doing so. [Related Case Law] Supreme Court, Judgment of Dec. 12, 2024, Case No. 2024Do10710 4. Can OTC, P2P, or USDT Trading Also Violate the Act? Trading virtual assets through OTC or P2P methods does not, by itself, make the trading illegal. What matters is the actual structure of the transactions. If a person purchases USDT with their own funds and trades it on their own account, this is likely closer to ordinary investment activity. On the other hand, the following types of trading warrant a review of whether they constitute an unregistered virtual asset business: Repeatedly buying and selling USDT or other assets at the request of multiple people Receiving Korean won and sending the corresponding virtual asset to the other party's wallet Continuing to trade while receiving fees or spreads Brokering or carrying out another person's virtual asset trading, exchange, or transfer on their behalf Accordingly, what matters is not simply the trading volume, but whose funds were used, how the counterparties were found, and what consideration was received. 5. What Are the Penalties for Violating the Act? The severity of the penalty depends on which reporting obligation was breached. Criminal penalties for violations of the Act Type of Violation Penalty Operating a virtual asset business without filing a report with the FIU Imprisonment for up to 5 years, or a fine of up to KRW 50 million Filing a report through false or fraudulent means and operating a business Imprisonment for up to 5 years, or a fine of up to KRW 50 million Failing to file a required notification of change Imprisonment for up to 3 years, or a fine of up to KRW 30 million Filing a notification of change through false or fraudulent means Imprisonment for up to 3 years, or a fine of up to KRW 30 million These statutory penalty ranges remain unchanged under the amended Act, which takes effect on August 20, 2026. That said, actual cases also take into account the period and scale of trading, the profit obtained, and each party's role and degree of involvement. Depending on the trading method used, it is also necessary to separately review whether charges such as violation of the Foreign Exchange Transactions Act, fraud, or offenses related to proceeds of crime may also apply. 6. What Should You Check If You Are Being Investigated for a Suspected Violation? The first step is to organize all trading activity into transactions made for your own investment and transactions made on behalf of others. A large volume of account deposits and withdrawals or virtual asset transactions does not, on its own, reveal the true nature of the trading. Before an investigation, it is worth reviewing the following materials: Trading and transfer records from exchanges and personal wallets Deposit and withdrawal records for accounts used in the trading KakaoTalk, Telegram, or other messages exchanged with counterparties The actual profit structure, such as fees or spreads received How each counterparty was found, and the role each participant played In particular, if funds were repeatedly received in Korean won from multiple people and virtual assets were sent in return, it is essential to first trace the flow of funds and determine which deposit corresponds to which virtual asset transaction. Based on this, you should be able to explain whether you were an investor trading on your own account, or someone who continuously and repeatedly carried out virtual asset trading on behalf of others. 7. Frequently Asked Questions Q1. Does trading coins frequently automatically mean I have violated the Act? Frequent trading alone does not constitute a violation. If the trading was carried out for your own benefit and on your own account, it may qualify as ordinary virtual asset investment. However, if you repeatedly traded at another person's request and received consideration for doing so, this requires separate review. Q2. If I buy USDT low and sell it high, do I need to file a report? Earning a profit from the price difference alone does not make someone a VASP. The determination depends on whether the profit came from personal investment, or from repeatedly supplying USDT to customers while receiving fees or spreads. Q3. Is it a problem if I bought coins on behalf of an acquaintance as a favor? A one-off favor and continuous, repeated conduct of this kind must be distinguished. Relevant factors include the number and period of the transactions, whether consideration was received, and how far the range of counterparties expanded. 8. Summary and Points to Note Whether a violation of the Act has occurred is not determined by the amount or frequency of virtual asset trading alone. The key factor in distinguishing personal investment from an unregistered virtual asset business is whose funds were used, for whose benefit the trading was carried out, and what consideration was received. In addition, from August 20, 2026, the registration review and certain notification-of-change procedures for VASPs will be strengthened, so existing operators should also confirm the requirements and filing deadlines under the revised registration manual. Decent Law Firm reviews VASP status, violation risk under the Act, and investigation response strategy based on the structure of virtual asset transactions and the flow of funds involved.
2026-08-14 -
Blogs Crypto
Unregistered Virtual Asset Service Providers in Korea: Registration Requirements and Penalties
Frequent trading of virtual assets does not, by itself, mean that you are required to register as a Virtual Asset Service Provider (VASP) in Korea. However, if you repeatedly buy, sell, exchange, transfer, broker, arrange, or facilitate virtual asset transactions for others and receive compensation for doing so, you may be considered a VASP subject to registration requirements under Korea’s Act on Reporting and Using Specified Financial Transaction Information (the “Specified Financial Information Act”). 1. What Is an Unregistered Virtual Asset Service Provider in Korea? A person or entity may be treated as an unregistered VASP if it conducts regulated virtual asset activities as a business without completing the required registration with the Korea Financial Intelligence Unit (KoFIU). The Specified Financial Information Act regulates businesses engaged in activities involving virtual assets, including the purchase and sale of virtual assets, exchanges between virtual assets, certain transfers, custody or management, and the brokerage, arrangement, or agency of virtual asset transactions. Accordingly, the rules are not limited to large centralized exchanges. Depending on the actual structure of the business, an individual or smaller operator may also fall within the scope of a VASP. Specified Financial Information Act, Article 7 ↗ 2. How Is VASP Status Determined? The key issue is not simply whether virtual assets were traded, but whether the relevant activities were carried out “as a business.” The Supreme Court of Korea has held that VASP status should be determined by considering the circumstances as a whole, including: the purpose and type of the transactions; the scale and frequency of the transactions; the period over which the transactions were conducted; and the manner in which the transactions were carried out. In particular, an ordinary exchange user who repeatedly buys or exchanges virtual assets solely for his or her own account and benefit will generally not be regarded as a VASP, absent special circumstances. By contrast, a person who repeatedly conducts virtual asset transactions for the benefit of an unspecified number of customers or users and receives compensation in return may, in principle, be regarded as a VASP. Supreme Court Decision 2024Do10710, Dec. 12, 2024 ↗ 3. How Are Personal Crypto Trading and VASP Activities Distinguished? The amount or frequency of trading is not the decisive factor. What matters more is for whom the transactions are conducted and how the business operates. Factor More Likely to Be Personal Trading May Require VASP Review Purpose Personal investment or profit Providing transaction services to customers Funds Trader’s own funds Funds connected to customers or third parties Counterparty Trading through an exchange for one’s own account Transactions involving multiple customers Compensation No separate fee Fees, spreads, or other compensation received Transaction method Trading based on one’s own decisions Buying, selling, exchanging, or transferring at a customer’s request Continuity Trading as part of personal investment activity Activities performed repeatedly as a business A high transaction volume or a large number of trades does not automatically make a person an unregistered VASP. Conversely, even if transactions are conducted through a personal bank account or wallet, VASP status may need to be reviewed where the person repeatedly provides transaction services to customers and earns fees or other compensation. 4. Can OTC, P2P, or Crypto Transaction Services Require VASP Registration? Yes. OTC or P2P transactions are not automatically subject to VASP registration, but the actual business model may fall within the regulated scope. For example, VASP issues may arise where an operator repeatedly: receives Korean won from customers and transfers USDT or other virtual assets in return; buys, sells, or exchanges virtual assets at a customer’s request; earns fees or profits through transaction spreads; or solicits customers through Telegram, open chat rooms, or similar online channels. The absence of a formal exchange platform or physical business location does not, by itself, exclude the activity from VASP regulation. In June 2026, KoFIU specifically identified private exchange operators that buy and sell stablecoins and other virtual assets in exchange for fiat currency as a type of unregistered virtual asset business activity requiring regulatory attention. KoFIU / Financial Services Commission – Official Source ↗ 5. Can an Overseas Virtual Asset Business Be Required to Register in Korea? Yes. An overseas business may be subject to Korean VASP registration requirements if it conducts business activities targeting users in Korea. KoFIU considers various factors when assessing whether an overseas virtual asset business is conducting business in Korea, including: whether a Korean-language website or service is provided; whether payments in Korean won are supported; whether customer acquisition campaigns target Korean users; and whether marketing activities are directed at users in Korea. In June 2026, KoFIU announced that it had identified eight illegal OTC operators and four overseas exchanges conducting business in Korea, referred the cases to the police, and requested domestic access restrictions for the relevant websites and applications. Accordingly, the fact that a company is incorporated or headquartered outside Korea does not, by itself, exempt it from Korean VASP regulations. KoFIU / Financial Services Commission – Official Source ↗ 6. What Are the Consequences of Operating as an Unregistered VASP? Operating a virtual asset business without the required registration may result in criminal liability under the Specified Financial Information Act. Under Article 17(1) of the Act, a person who conducts virtual asset transactions as a business without filing the registration required under Article 7(1) may be subject to imprisonment for up to five years or a fine of up to KRW 50 million. Specified Financial Information Act, Article 17(1) ↗ In addition, amendments to the Specified Financial Information Act scheduled to take effect on August 20, 2026 will strengthen the entry and registration requirements applicable to VASPs. The amended framework expands the review of matters such as the financial condition and social credibility of the VASP and its major shareholders, as well as organizational, personnel, IT infrastructure, and internal control requirements. Financial Services Commission – Official Source ↗ KoFIU has also taken measures against unregistered operators, including referrals to investigative authorities, requests to restrict domestic access to websites and mobile applications, and restrictions involving transactions with registered VASPs. KoFIU / Financial Services Commission – Official Source ↗ If you have already conducted transactions that may fall within the scope of VASP activities, it is advisable to organize the relevant transaction records, bank account and wallet flows, communications with customers, fee or spread structures, and the specific role you performed before assessing the applicable regulatory and legal risks. 7. Frequently Asked Questions (FAQ) Q1. If I frequently buy and sell USDT, am I automatically considered a VASP? No. Frequent trading alone does not automatically make you a VASP. It is necessary to consider whether you were trading with your own funds for your own benefit or conducting transactions for customers in return for fees or other compensation. Q2. Do I need to register if I occasionally buy crypto on behalf of a friend? Not necessarily. An isolated transaction performed at the request of a friend does not, by itself, determine VASP status. The analysis may change depending on factors such as the number and range of counterparties, transaction frequency and duration, whether compensation was received, and whether the activity was carried out continuously or repeatedly. Q3. Am I outside the VASP rules if I do not have a registered business? No. The absence of a Korean business registration does not, by itself, determine whether you are a VASP under the Specified Financial Information Act. Even an individual operating through a personal account or wallet may need to consider VASP registration requirements if the person repeatedly provides virtual asset-related services to customers for profit. 8. Key Takeaways Whether a person or business constitutes an unregistered VASP in Korea depends not simply on the volume of crypto trading, but primarily on whether virtual asset-related services are repeatedly provided to customers as a business. For OTC, P2P, or transaction-facilitation arrangements in particular, the purpose of the transactions, counterparties, flow of funds, fee structure, and the operator’s actual role should be reviewed together. Decent Law Firm advises clients on whether their virtual asset business models fall within Korea’s VASP regulatory framework, including registration requirements under the Specified Financial Information Act and legal risks associated with unregistered operations.
2026-08-13 -
Blogs Crypto
Korea Refers Approximately 30 Virtual Asset Market Manipulation Cases for Investigation: Key Findings and Legal Risks
The Financial Services Commission and the Financial Supervisory Service have released the results of their first two years of enforcement under Korea’s Virtual Asset User Protection Act. As of July 20, 2026, the authorities had completed investigations into approximately 40 cases and referred or reported around 30 cases to investigative authorities. A total of 25 individuals were identified as suspects, with average alleged unlawful gains of approximately KRW 1.4 billion per case. Enforcement Results Under Korea’s Virtual Asset User Protection Act Korea’s Virtual Asset User Protection Act took effect on July 19, 2024. The Act prohibits unfair trading activities in the virtual asset market, including the misuse of material non-public information, market manipulation, and fraudulent trading practices. Among the approximately 30 cases referred or reported to investigative authorities, most involved suspected market manipulation. The authorities also identified several fraudulent trading cases involving false or misleading information distributed through social media. The key enforcement figures announced by the Korean financial authorities include: ▪️ Approximately 40 investigations completed ▪️ Approximately 30 cases referred or reported to investigative authorities ▪️ 25 individuals identified as suspects ▪️ Average alleged unlawful gains of approximately KRW 1.4 billion per case ▪️ An average of approximately eight virtual assets involved per case A referral or report does not mean that a criminal conviction has been entered. It means that the financial authorities identified suspected violations and transferred the matter to investigative authorities. Some of the announced cases remain under criminal investigation or are currently being tried in court. Market Manipulation Methods Identified by Korean Regulators Manipulating Price-Ranking Systems One method involved concentrating orders at specific times when a trading platform’s price-change rankings were reset. By pushing a virtual asset into the list of top-performing assets, traders could attract additional buying interest and then sell their existing holdings at higher prices. A large purchase made at a particular time does not automatically constitute market manipulation. However, regulators may examine whether the orders were intended to influence rankings, attract other investors, and facilitate the subsequent disposal of previously held assets. Exploiting Temporary Suspension of Deposits and Withdrawals Another method involved taking advantage of situations in which deposits and withdrawals of a particular virtual asset were temporarily suspended on one or more exchanges. When assets cannot be transferred to or from the exchange, the price on that exchange may become temporarily disconnected from prices elsewhere. Traders may attempt to increase the internal exchange price through concentrated purchases and then sell their holdings at the inflated price. A deposit or withdrawal suspension is not itself evidence of misconduct. The legal issue is whether a person deliberately exploited the restricted market environment to create an artificial price and induce trading by other users. High-Frequency and Deceptive Orders Using APIs An application programming interface, or API, allows orders to be submitted automatically through trading software. The authorities identified cases in which API keys and multiple accounts were allegedly used to submit high-frequency buy and sell orders, including orders that were not intended to be genuinely executed. In one case, the authorities found that automated orders and deceptive bids were allegedly used to increase the market price before virtual assets associated with the issuing foundation were sold at higher prices. Using an API or automated trading system is not unlawful by itself. The key question is whether the orders reflected a genuine intention to trade or were designed to create a false impression of market demand and induce other users to buy or sell. False Social Media Statements and Meme Coin Trading The authorities also identified a case in which persons connected to a meme coin allegedly purchased the asset in advance, published false information through social media, and then sold their holdings after additional buyers entered the market. Promoting a virtual asset project, exchange listing, partnership, or business plan is not automatically unlawful. However, publishing nonexistent investment arrangements, partnerships, or development plans as if they were true—and using that information to sell previously acquired assets—may constitute fraudulent trading under Korean law. How Is Legitimate High-Volume Trading Distinguished from Market Manipulation? Purchasing an asset before its price rises and later selling it at a profit does not, by itself, establish market manipulation. Korean financial and investigative authorities generally examine the purpose and overall pattern of the trading activity rather than viewing each order in isolation. Relevant factors may include: ▪️ Whether repeated high-priced purchases or deceptive orders were submitted ▪️ Whether there was a genuine intention to execute the orders ▪️ Whether multiple accounts acted under common instructions ▪️ Whether the accounts were connected to an issuing foundation or major holder ▪️ Whether significant holdings were sold immediately after the price increased ▪️ Whether social media posts were closely connected to the timing of sales ▪️ Whether orders across Korean and overseas exchanges were coordinated Even where accounts or API keys were registered in another person’s name, investigators may examine who actually controlled the trading, who gave the instructions, and who ultimately received the profits. Criminal Penalties and Administrative Surcharges Virtual asset market manipulation and fraudulent trading may result in both criminal penalties and administrative surcharges intended to recover unlawful gains. According to the financial authorities’ announcement, the statutory minimum term of imprisonment increases according to the amount of unlawful gains: ▪️ Less than KRW 500 million: imprisonment for at least one year ▪️ KRW 500 million to less than KRW 5 billion: imprisonment for at least three years ▪️ KRW 5 billion or more: imprisonment for at least five years The actual penalty may vary depending on the conduct involved, the calculation of unlawful gains, the level of participation, and whether additional fines, confiscation, or collection orders are imposed. In the announced enforcement results, administrative surcharges equivalent to approximately 125% to 165% of the unlawful gains were imposed in one fraudulent trading case and one market manipulation case. A market manipulation matter may therefore proceed beyond an exchange account restriction. It may lead to regulatory investigation, referral or reporting to investigative authorities, criminal investigation, prosecution, trial, and a separate administrative surcharge proceeding. AI-Based Monitoring and Future Regulatory Measures Korean financial authorities have introduced AI-based market surveillance and investigation systems capable of conducting real-time monitoring, analyzing orders on a second-by-second basis, and automatically identifying potentially suspicious accounts and trading periods. Korean virtual asset exchanges have also strengthened their continuous monitoring systems. Exchanges may report suspicious trading to financial or investigative authorities and may issue warnings or restrict orders when potentially abusive trading patterns are repeatedly detected. The authorities are also considering whether to include the following measures in the proposed second-stage Digital Asset Act: ▪️ Freezing accounts and financial accounts to prevent the concealment of unlawful gains ▪️ A reporting and reward system for the early detection of unfair virtual asset trading These measures were under consideration at the time of the announcement and should not be treated as fully implemented rules. Responding to a Market Manipulation Investigation in Korea A person who receives an account restriction or a request for an explanation from a Korean virtual asset exchange should first identify the specific orders and trading periods under review. Where automated trading or market-making activities were conducted, relevant evidence may include: ▪️ Order, execution, and API usage records ▪️ Automated trading settings and documented trading strategies ▪️ The relationship between the registered account holder and the actual operator ▪️ Communications with the issuing foundation or major asset holders ▪️ Transfers between personal wallets and virtual asset exchanges ▪️ The basis and circumstances for social media statements ▪️ Records showing how trading profits were received and distributed Automated trading or high-volume trading does not automatically establish market manipulation. However, simply stating that the activity was a legitimate investment may not be sufficient. The trading purpose, genuine intention to execute orders, relationship between accounts, and ultimate recipient of the profits should be explained through objective records. Decent Law Firm advises clients on exchange inquiries, investigations by Korean financial authorities, police and prosecution proceedings, and criminal trials involving alleged virtual asset market manipulation and fraudulent trading. This content is provided for general informational purposes only and does not constitute legal advice for any individual matter.
2026-07-21 -
Blogs Crypto
South Korea Expands Voice-Phishing Refund Protection to Crypto Assets from October 2026
Until now, victims often faced difficulties when money stolen through voice phishing was converted into Bitcoin, USDT, or another crypto asset before the relevant account could be frozen. This is expected to change from October 2026. South Korea is expanding its telecommunications financial fraud refund framework so that crypto assets can also be subject to account-freezing and victim-refund procedures. On July 15, 2026, the Financial Services Commission announced a proposed amendment to the Enforcement Decree setting out how crypto assets will be returned, valued, and, where necessary, sold on behalf of victims. Crypto Assets Will Be Included in the Voice-Phishing Refund Framework South Korea’s existing voice-phishing refund system has primarily focused on money remaining in bank accounts. This created a practical gap. Even where stolen funds could be traced to a crypto exchange account, the existing statutory process was not always able to deal effectively with assets that had already been converted into cryptocurrency. To address this issue, legislation promulgated on March 31, 2026 expanded the scope of recoverable assets from money to crypto assets. As a result, the revised framework may apply to cases such as: ▪️ A victim purchasing and transferring crypto assets at the direction of a voice-phishing operation ▪️ Korean won transferred by a victim being converted into Bitcoin, USDT, or another crypto asset ▪️ Stolen crypto assets remaining in an account subject to the revised refund framework The amended law is scheduled to take effect on October 1, 2026. What Happens If the Stolen Money Has Already Been Converted into Crypto? One of the most important parts of the proposed Enforcement Decree concerns the form in which the victim will receive the recovered assets. Where the recoverable asset is money, it will be returned as a monetary amount. Where it is a crypto asset, it will generally be returned according to the type and quantity of that asset. However, the asset originally transferred by the victim may be different from the asset remaining in the fraudulent account when the account is frozen. In that situation, the victim will generally receive the asset that actually remains in the account at the time of the freeze. For example, suppose a victim transfers KRW 10 million and the perpetrators convert the money into USDT. If the relevant account is frozen while the USDT is still there, the refund may be made based on the remaining USDT rather than the original amount of Korean won. Crypto Assets Will Be Valued at the Time of the Account Freeze A fraudulent account may contain a mixture of Korean won and several types of crypto assets. Where different forms of property are mixed together, the proposed rules provide that: ▪️ Money will be valued according to its monetary amount ▪️ Crypto assets will be valued according to their market price at the time of the account freeze This timing matters. The relevant price is not necessarily the price when the victim made the transfer or when the refund is eventually paid. Instead, the valuation is based on the market price when the freeze took effect. Because crypto prices can change rapidly, a prompt report to the police, financial institution, and relevant crypto exchange may be important not only for preventing further transfers, but also for determining the value of the recoverable assets. Victims May Receive Cash Through a Crypto Sale Support Institution Receiving crypto assets directly may not be practical for every victim. A victim may have no experience trading crypto, may not have an exchange account, or may not know how to sell and withdraw the asset in Korean won. The proposed Enforcement Decree therefore introduces requirements for institutions that may support the sale of recoverable crypto assets. Where a victim has difficulty disposing of the crypto directly, a designated institution may sell the asset and pay the proceeds to the victim in cash. To qualify, the institution must have the organization and personnel necessary to support crypto users and assist with victim recovery. The designated institution and the detailed application procedure will need to be confirmed once the final rules and administrative guidance are issued. Not Every Crypto Scam Will Qualify for a Refund The expanded framework does not mean that every crypto-related loss will automatically be refunded. The case must first fall within the statutory definition of telecommunications-based financial fraud. Ordinary investment losses, failed private transactions, and contractual disputes are not automatically treated as voice-phishing cases. Investment advisory scams and romance scams may also require a closer review of: ▪️ How the victim was deceived ▪️ Why the money or crypto was transferred ▪️ Whether the transaction formed part of a telecommunications-based fraud scheme ▪️ Where the assets were located when the freeze was requested The refund system is also not a government guarantee covering the victim’s entire loss. Assets must generally remain in the relevant fraudulent account when the freeze takes effect. Where the remaining assets belong to multiple victims, the actual refund may depend on the amount left and the scale of each victim’s loss. If the crypto has already been transferred to a private wallet or an overseas exchange, separate measures may be required, including a criminal complaint, wallet tracing, transaction analysis, and preservation requests directed to relevant exchanges. Information Victims Should Preserve Immediately Crypto assets can move rapidly through multiple wallets and exchanges. Early action is therefore critical. A victim should promptly contact the police, the bank used for the transfer, and the relevant crypto exchange to determine whether the account or asset can be frozen. The following records should also be preserved: ▪️ Messages exchanged with the perpetrators ▪️ Call recordings and telephone numbers ▪️ Bank transfer confirmations ▪️ Crypto purchase and transfer records ▪️ Sending and receiving wallet addresses ▪️ Transaction IDs, also known as TXIDs ▪️ Information identifying the exchange and user account involved Bank records alone may not reveal the full movement of the assets. It is often necessary to organize the entire transaction history chronologically, from the original payment through the purchase and transfer of the crypto assets. How Decent Law Firm Can Assist Decent Law Firm’s Virtual Asset Practice reviews the transaction structure and movement of funds in crypto-related voice-phishing cases. Depending on the circumstances, our assistance may include: ▪️ Preparing materials for submission to Korean investigative authorities ▪️ Coordinating responses involving banks and crypto exchanges ▪️ Organizing wallet addresses, TXIDs, and transaction records ▪️ Assessing whether the statutory refund procedure may apply ▪️ Preparing a criminal complaint and related asset-recovery measures Cases involving multiple wallets, private wallets, or overseas exchanges may require the statutory refund process to be combined with separate criminal and asset-tracing strategies. The proposed Enforcement Decree is open for public comment from July 15 to August 24, 2026, and is scheduled to take effect together with the amended law on October 1, 2026. As the rules have not yet been finalized, some details and procedures may change before implementation.
2026-07-16 -
Blogs Crypto
The CATFI Rug Pull Case and Unfair Trading Under Korea’s Virtual Asset User Protection Act
Meme coins often attract investors because they can be launched relatively quickly and may experience sharp price increases within a short period. Decentralized exchanges, or DEXs, facilitate trades through smart contracts and automated protocols rather than a centralized order-matching system. Once a token has been issued, trading can begin by creating a liquidity pool without going through the formal listing review typically required by a centralized exchange. This structure can attract investors seeking early exposure to newly launched tokens. At the same time, there has been growing concern over so-called rug pulls, in which project operators use false or misleading information to drive up the price of a token and then sell their holdings all at once. In May 2026, the Seoul Southern District Prosecutors’ Office indicted individuals involved in the issuance of the meme coin CATFI on charges including violations of Korea’s Act on the Protection of Virtual Asset Users. Prosecutors alleged that the defendants circulated false positive announcements, manipulated the token’s trading activity, and obtained unlawful profits. The case was the first in which prosecutors applied the Act’s provisions on fraudulent unfair trading. This article examines the laws that may apply to rug pulls and the key legal issues arising from such cases. Laws That May Apply to Rug Pull Schemes A rug pull is not a separately defined criminal offense under Korean law. Depending on how the scheme was structured, several provisions may apply. Where false disclosures, artificial trading activity, or market manipulation are involved, Article 10 of the Act on the Protection of Virtual Asset Users, which prohibits unfair trading practices, may become relevant. Category Main Conduct Relevant Provision Use of material non-public information A virtual asset service provider, issuer, or other relevant party uses undisclosed material information for trading Article 10(1) Market manipulation through matched or wash trades Parties coordinate transactions in advance or conduct trades without a genuine transfer of economic ownership Article 10(2) Market manipulation through actual trades Trades are carried out to induce others to buy or sell by artificially moving the market price Article 10(3) Fraudulent unfair trading A person uses fraudulent means, schemes, or deceptive practices, or makes false statements about material facts Article 10(4) If the parties behind a rug pull used multiple wallets to trade among themselves and artificially inflate transaction volume, Article 10(2) may apply. If investors were attracted through false lock-up announcements, fabricated social media engagement, or other misleading representations, Article 10(4) may also become relevant. A violation of these provisions may result in imprisonment for at least one year or a fine equal to three to five times the profit obtained or loss avoided through the violation under Article 19(1). Where the unlawful profit or avoided loss is at least KRW 500 million but less than KRW 5 billion, the offender may be sentenced to imprisonment for at least three years. Where the amount is KRW 5 billion or more, the punishment may be life imprisonment or imprisonment for at least five years under Article 19(3). Separate from criminal penalties, the Financial Services Commission may also impose an administrative surcharge in connection with unfair trading conduct. Administrative sanctions and criminal proceedings are legally distinct and may be pursued through separate procedures. The CATFI Case and the Legal Test for a Rug Pull According to the prosecution, the individuals involved in CATFI divided their holdings across multiple wallets and announced a lock-up plan on social media even though the promised restrictions were not actually observed. An influencer allegedly presented himself as an independent third party with no connection to the issuing group and encouraged investors to purchase the token. The defendants were also accused of using multiple wallets to create the appearance of active trading and rising demand. Once purchases by ordinary investors increased, they sold their holdings in a large-scale disposal. The token reportedly increased in value by approximately 1,001 times within 26 hours of issuance. Around 6,000 individuals purchased the token, and 256 investors were found to have suffered losses totaling approximately KRW 900 million. Prosecutors alleged that the defendants used approximately KRW 10 million in initial funds and obtained roughly KRW 400 million in sale proceeds. At the first trial hearing held on June 30, 2026, the defendants admitted the charges. Prosecutors requested a sentence of four years and six months for the influencer alleged to have led the scheme. However, a sharp decline in a token’s price or the failure of a project does not automatically establish a criminal rug pull. Virtual asset investments inherently involve price volatility. It is therefore necessary to distinguish between a genuine business failure and a scheme designed from the outset to deceive investors and extract funds. In practice, investigators may examine whether: ▪️ The parties had planned to sell their holdings before the token was issued or concealed the true amount held by the project team ▪️ Lock-up or token-burning plans were falsely announced, or holdings were distributed across multiple wallets to disguise common ownership ▪️ Trading volume and price movements were artificially created, followed by the closure of social media channels or online communities immediately after the sale Key Legal Issues and Response Options 🔹Criminal Liability of Influencers and Marketing Personnel A person does not avoid criminal liability simply because they did not personally issue the token. An influencer, marketing agency, or account operator may be investigated as a principal offender or an accomplice if they coordinated with the issuing group, published false information, or recommended the token while falsely presenting themselves as an independent third party. Relevant evidence may include: ▪️ Records showing that tokens were transferred to the promoter before the marketing campaign ▪️ Messages concerning the sharing of sale proceeds or trading profits ▪️ Records showing that promotional content was published despite knowledge that the information was false These materials may be important in determining whether the person merely provided advertising services or knowingly participated in the scheme. 🔹Options for Investor Recovery Article 10(6) of the Act on the Protection of Virtual Asset Users provides that a person who violates the unfair trading provisions may be liable for losses caused to users by the violation. Accordingly, investors may consider a civil claim for damages separately from any criminal complaint or prosecution. In practice, however, recovery may be difficult where the issuer operated through anonymous wallets. Identifying the responsible parties and proving a causal connection between the unlawful conduct and the investment loss can require a detailed review of both blockchain records and online promotional materials. Investors should therefore preserve relevant evidence as early as possible, including wallet addresses, transaction hashes, purchase records, social media posts, and announcements concerning lock-ups, listings, or partnerships. Decent Law Firm’s Virtual Asset Practice The CATFI case demonstrates that even where a meme coin is traded through a DEX, false announcements, coordinated trading, and artificial price movements may lead to liability under Korea’s Virtual Asset User Protection Act. It also shows that affected investors may need to consider both criminal proceedings and civil claims for damages. Decent Law Firm’s Virtual Asset Practice reviews on-chain transaction structures and blockchain fund flows in connection with rug pulls, market manipulation, criminal complaints, investigations, and civil damages claims. Where an investment loss appears to involve a rug pull or other unfair trading conduct, legal advice should be obtained at an early stage, beginning with the preservation and review of evidence. This content is provided for general informational purposes only and does not constitute legal advice for any specific matter.
2026-07-14 -
Blogs Crypto
Virtual Asset “Hwanchigi” in Korea: Penalties and Key Changes Under the 2026 Foreign Exchange Transactions Act
As cross-border transactions involving virtual assets and overseas payment services continue to increase, Korean regulators are paying closer attention to whether such transactions constitute unlicensed foreign exchange business or illegal remittance activities. The Korea Customs Service recently conducted targeted inspections of high-risk money exchange businesses and identified violations involving false transaction records, foreign currency sales exceeding statutory limits, and failures to report large cash transactions. The businesses selected for inspection also included entities suspected of using virtual assets for illegal cross-border remittances. A major regulatory change will take effect on December 3, 2026, when the amended Foreign Exchange Transactions Act comes into force. Under the amended Act, certain cross-border virtual asset transfer services will become subject to a separate registration requirement. Virtual asset service providers, payment companies, remittance operators, and businesses offering cross-border settlement services should review whether their current business models fall within the scope of the new registration regime. What Is “Hwanchigi” Under Korean Law? “Hwanchigi” is not a term expressly defined in the Foreign Exchange Transactions Act. It generally refers to an arrangement in which funds are transferred across borders without using a bank or another authorized foreign exchange institution. Instead, separate pools of funds or accounts in Korea and another country are used to produce the same economic effect as an international remittance. For example, a person in Korea may pay Korean won to a local operator, while the operator’s overseas partner pays an equivalent amount in foreign currency to the intended recipient abroad. The Korean won received in Korea is not physically transferred overseas. Nevertheless, because a corresponding payment is made abroad, the arrangement produces substantially the same result as an international remittance. Article 8 of the Foreign Exchange Transactions Act generally requires a person who engages in foreign exchange business as a commercial activity to obtain the necessary registration. A person may therefore be regarded as participating in foreign exchange business even if they did not personally send money overseas, provided that their role formed part of a broader structure designed to complete a cross-border payment. A Transaction May Be Regulated Even If No Foreign Currency Crosses the Border Under Korean foreign exchange law, the key issue is not whether the same cash or foreign currency physically crossed the border. What matters is whether payments made in Korea and abroad were connected in a manner that produced the same economic effect as a cross-border transfer. Common structures that may raise regulatory concerns include the following. ▪️ Korean Won Received in Korea and Foreign Currency Paid Overseas A Korean account receives the funds, while an overseas partner or local office pays foreign currency to the designated recipient abroad. ▪️ Funds Received Overseas and Korean Won Paid in Korea Foreign currency or local currency is received outside Korea, and Korean won is then paid into a designated Korean bank account. ▪️ Settlement Through Third-Party Accounts Funds are paid or received through accounts held by family members, employees, acquaintances, or unrelated business entities rather than the actual sender or recipient. ▪️ Offshore and Domestic Obligations Offset Against Each Other Amounts payable in Korea and abroad are offset, allowing the parties to settle without making a conventional international bank transfer. If these transactions are conducted repeatedly and the operator earns fees or profits from exchange-rate differences, the activity may be treated as unregistered foreign exchange business. Why the Supreme Court Treated Virtual Asset Arbitrage as Foreign Exchange Business In its September 4, 2025 decision, Supreme Court Case No. 2024Do16540, the Court confirmed that a transaction may constitute foreign exchange business even where no foreign currency was directly transferred across the border. In that case, the defendant received virtual assets from a non-resident located overseas, sold them through a Korean virtual asset exchange, and transferred the proceeds in Korean won to multiple domestic bank accounts designated by the non-resident. The defendant did not personally remit foreign currency overseas. Nevertheless, the Supreme Court upheld the lower court’s finding that the transaction performed substantially the same function as an inbound remittance service, in which a Korean foreign exchange bank pays Korean won to a domestic recipient based on payment instructions from a foreign bank. The relevant question was therefore not simply whether the defendant had directly sent funds abroad. The Court examined whether the overall transaction structure effectively facilitated payments between Korea and another country. However, the sale of virtual assets followed by a domestic Korean won transfer does not automatically constitute unregistered foreign exchange business in every case. The following factors should be considered together: ▪️ The purpose and background of the transaction ▪️ The size and frequency of the transactions ▪️ The duration and degree of repetition ▪️ Whether fees or exchange-rate profits were earned ▪️ Whether the activity was conducted as a business Can Virtual Assets and Overseas Payment Services Be Treated as Hwanchigi? The use of virtual assets or overseas payment services does not, by itself, exclude a transaction from the application of Korean foreign exchange laws. ▪️ Receiving Korean Won and Sending Virtual Assets to an Overseas Wallet Where Korean won is received in Korea and Bitcoin, USDT, or another virtual asset is sent to an overseas recipient in return, the transaction may be treated as a cross-border payment service rather than a simple virtual asset sale. ▪️ Receiving Virtual Assets Overseas and Paying Korean Won in Korea A transaction may also be treated as cross-border payment activity where virtual assets received from overseas are sold in Korea and the proceeds are paid into domestic accounts designated by the overseas party. ▪️ Settling Funds Through WeChat Pay or Alipay Regulatory concerns may arise where Korean won is received in Korea and an overseas payment account is funded abroad, or where funds are received overseas and Korean won is paid to a recipient in Korea. These transactions are not automatically illegal. The authorities will generally examine: ▪️ Whether the domestic payment corresponded to an overseas payment ▪️ Whether third-party accounts were used ▪️ Whether the activity was repeated ▪️ Whether the operator earned fees or exchange-rate profits ▪️ Whether the transaction was conducted for a commercial purpose Key Changes Under the 2026 Amendment to the Foreign Exchange Transactions Act The amended Foreign Exchange Transactions Act was promulgated on June 2, 2026 and will take effect on December 3, 2026. The amendment introduces three major changes. ▪️ Registration Requirement for Cross-Border Virtual Asset Transfer Services A virtual asset service provider that uses virtual asset sales, purchases, or exchanges to transfer value between Korea and another country, or to produce substantially the same effect, will be required to register with the Minister of Economy and Finance. A virtual asset service provider registration under the Act on Reporting and Using Specified Financial Transaction Information may not be sufficient by itself. A separate registration under the Foreign Exchange Transactions Act may be required where the business provides cross-border virtual asset transfer services. ▪️ Stronger Administrative Sanctions for Operating Outside the Registered Scope A specialized foreign exchange business operator that conducts foreign exchange activities outside its registered scope may be subject to: ▪️ Cancellation of registration ▪️ Business restrictions ▪️ Suspension of business ▪️ Administrative surcharges imposed in place of certain suspension measures Businesses should therefore confirm that their actual services remain within the scope of their registration. ▪️ Criminal Penalties for Unregistered Business and Certain Payment Procedure Violations A person who conducts cross-border virtual asset transfer business without registration may be subject to: ▪️ Imprisonment for up to three years ▪️ A fine of up to KRW 300 million The amended Act also introduces criminal penalties of: ▪️ Imprisonment for up to one year ▪️ A fine of up to KRW 100 million These penalties may apply where a person violates prescribed payment procedures for the purpose of obtaining an improper financial benefit for themselves or another person. The amendment does more than simply clarify which businesses must register. It expressly brings cross-border virtual asset transfer services within the registration framework and clarifies the scope of criminal liability for unregistered activities and certain payment procedure violations. The Substance of the Fund Flow Matters More Than the Name of the Transaction Virtual asset-based hwanchigi and arbitrage cases are primarily governed by the Foreign Exchange Transactions Act. Depending on the transaction structure, the following laws may also apply: ▪️ The Act on Reporting and Using Specified Financial Transaction Information ▪️ The Virtual Asset User Protection Act ▪️ Other criminal and financial regulations related to money laundering, fraud, or unlawful fund transfers Businesses and individuals should review the entire flow of funds, including: ▪️ The roles of the parties ▪️ Domestic and overseas bank transactions ▪️ Wallet transfers and transaction records ▪️ Fee and exchange-rate arrangements ▪️ The frequency and commercial nature of the activity Decent Law Firm’s Virtual Asset Practice Group advises clients on investigations involving alleged violations of the Foreign Exchange Transactions Act and virtual asset-based remittance activities. We also assist virtual asset businesses, payment providers, and cross-border settlement operators in assessing whether their services are subject to registration under the amended Act. Where the Korea Customs Service or the police requests attendance or submission of documents, or where a business needs to determine whether its services fall within the amended regulatory framework, the transaction structure and supporting records should be reviewed before responding. This publication is provided for general informational purposes only and does not constitute legal advice for any specific matter.
2026-07-13 Naver Blog
