We Resolve Legal Matters
How can we assist you?
Blogs
More-
Crypto Hacking Response Guide: What to Do First After You Discover a Breach
1. What Should You Check First When You Discover You've Been Hacked? The first thing to determine is exactly how your crypto assets left your control. Even incidents that look like the same "crypto hacking" can involve very different response strategies and liability structures — a compromised exchange account, a leaked wallet seed phrase, and a fraudulent signature approved on a phishing site are not the same problem. So as soon as you confirm the loss, the first step is to identify which type of incident you are dealing with. Type of Incident What to Check First Immediate Response Exchange account compromised Login history, withdrawal history, whether 2FA settings were changed Request an account/withdrawal freeze Personal wallet compromised Whether the seed phrase or private key was exposed Consider moving remaining assets to a new, secure wallet Phishing site interaction The URL visited, and any signatures or token approvals granted Block further approvals/access and preserve evidence Malware/remote access Installed programs, access and execution logs Stop using the infected device and preserve evidence Exchange-side breach The exchange's incident notice, affected assets, and scope of damage Check the exchange's notice and claims procedure Identifying the type of incident first makes it much easier to determine what evidence to gather and who may ultimately be liable. In particular, if the loss occurred while using an exchange, it is worth checking not only how well you managed your own account, but also whether the exchange was properly safeguarding user assets. Under Article 7 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to keep their own assets separate from user assets and to actually hold the same type and quantity of virtual assets entrusted to them by users. In addition, the current Regulation on Supervision of Virtual Asset Business requires at least 80% of the economic value of user assets to be kept in an environment separated from the internet (cold storage). So if the breach occurred at an exchange, rather than concluding simply that "the account was hacked," it is important to work out exactly how authentication was carried out and which account or wallet the withdrawal came from, since this will affect how liability is ultimately determined. 2. What Should You Do Immediately to Stop Further Losses? Once you confirm the breach, the first priority is to stop any remaining crypto assets from being drained further. If the breach occurred on an exchange account, the first step is to contact the exchange's customer support or incident report channel to check whether login or withdrawals can be restricted. At this stage, don't stop at simply changing your exchange password — check whether other authentication methods, such as your email, phone number, or OTP, may also have been compromised. If the issue originated in a personal wallet, the seed phrase or private key itself may already be exposed. In that case, rather than continuing to use the same wallet, you should consider creating a new wallet in a verified, secure environment and moving any remaining assets there. That said, be careful about immediately resetting a compromised phone or computer. The device may still hold records — phishing site visit history, malware, login logs — that show exactly how the account or wallet was compromised. What to Check Immediately After a Crypto Hacking Incident Request a freeze on further withdrawals from the exchange account Check whether your password, OTP, or other authentication methods were compromised Review protective measures for any remaining crypto assets Avoid resetting the affected device without careful thought Preserve withdrawal alert emails, texts, and app notifications Save your exchange customer support inquiries and their responses What matters at this stage is not rushing into every possible action, but balancing preventing further damage with preserving evidence. At Decent Law Firm, in the initial consultation we first identify the structure of the incident — whether it involves a compromised exchange account, a compromised personal wallet, or phishing/remote access — and based on that, help determine what evidence should be preserved first and what should be requested from the exchange. 3. What Evidence Should You Secure After a Crypto Hacking Incident? Once you've stopped further losses, the next step is to gather as much evidence as possible showing how the stolen assets moved. In crypto cases, what matters most is not just a screenshot of the loss, but the transaction records showing exactly when the assets moved, from which address to which address. Where possible, try to preserve the following information in as close to its original form as possible. Evidence You Should Secure Date and time of the incident Type and quantity of the stolen crypto assets Value of the assets in Korean won at the time of the loss The withdrawal (sending) wallet address The receiving wallet address The TXID or transaction hash The exchange or wallet service used Login and access notifications OTP, phone, and email authentication records Password change notifications Records of exchange customer support inquiries The phishing site URL Related text messages, emails, and messenger conversations Information on any suspicious programs or apps Of these, the TXID and wallet addresses are the core evidence for tracing how the assets moved afterward. On public blockchains, a block explorer can be used to trace how assets moved from the initially compromised address to other addresses. Records kept internally by the exchange also matter. Under Article 9 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to retain transaction records — sufficient to trace, search, and verify transactions — for 15 years from the end of the transactional relationship. However, the fact that an operator retains transaction records is a separate question from whether a victim can immediately obtain all of the internal data they want. Login IP addresses, authentication data, withdrawal approval processes, and other internal system records may not be voluntarily disclosed by the exchange, and may need to be obtained through the proper legal process during an investigation. So before filing a report, it helps to separate what you can gather yourself now from what will need to be obtained later through the investigating authorities. At Decent Law Firm, based on the transaction history, TXIDs, wallet addresses, and exchange responses a victim has secured, we organize a chronological timeline of how the assets moved from the moment of the loss, and structure the facts and evidence so they can be used effectively in a police report or criminal complaint. 4. Can Crypto Assets Already Moved to Another Wallet Still Be Traced or Frozen? Even after crypto assets have moved to another wallet, it is sometimes still possible to trace the transaction path on the blockchain. However, being traceable and being actually recoverable are two different questions. On public blockchains, the transfer from the originally compromised wallet to another wallet remains on the record. So it is possible to check where the stolen assets moved afterward, and whether they show signs of having flowed into a domestic or overseas centralized exchange. In particular, if the assets are confirmed to have moved into a deposit address at an identity-verified centralized exchange, the account information and transaction records held by that exchange can become important evidence for an investigation. Factors to Check When Assessing Recovery Potential Factor What It Means Current custody wallet Whether the stolen assets still remain at that address Inflow to a centralized exchange Whether identity verification may be possible through an exchange account Further movement of assets Whether the assets were quickly split across multiple addresses Change of chain Whether the assets were moved to another network via a bridge Asset conversion Whether the assets were converted into a different crypto asset Use of an overseas operator Whether cooperation from a foreign exchange or international cooperation is needed That said, confirming that assets moved on the blockchain does not mean those assets can be immediately frozen. Reporting and freezing procedures differ from exchange to exchange, and actually freezing assets or obtaining account information may require legal process, such as a request from investigating authorities or a warrant. In addition, if assets have been split across multiple wallets, moved to a different chain, or converted into a different crypto asset, tracing and recovery become considerably more complex. So you should not assume either that "there is a blockchain record, so recovery is guaranteed" or, conversely, that "the assets already moved to another wallet, so recovery is impossible." At Decent Law Firm, based on the secured TXIDs and wallet addresses, we map out how the assets moved, and where there are signs that assets flowed into a specific exchange, we organize the material so that fact is clearly communicated to the investigating authorities. Where an overseas exchange is involved, we also consider that exchange's own damage-reporting and evidence-preservation procedures, along with whether international cooperation through Korean investigating authorities is needed. 5. What Is the Right Order for Filing a Police Report and Seeking Recovery? Once you have organized the facts of the loss and the basic transaction data, the next step is to consider filing a report with the investigating authorities. You can report hacking and other cybercrime damage through the Korean National Police Agency's Cybercrime Reporting System (ECRM), which asks you to specify the date and details of the loss and describe how the crime occurred. In crypto cases, rather than simply stating "my coins were hacked," it is important to organize and submit materials that let investigators immediately understand the structure of the incident. What to Organize Before Filing a Report 1) How the Incident Occurred Note the last time you used the account normally, and when you first noticed the unusual withdrawal. 2) The Assets Affected Summarize the type and quantity of crypto assets involved, and the total loss. 3) The Fraudulent Transaction Confirm the TXID and the sending/receiving wallet addresses. 4) Signs of Account Compromise Note any confirmed signs such as foreign IP access, password changes, OTP changes, or a compromised email account. 5) Movement of the Assets After the Theft If you can confirm the assets moved to another wallet or exchange, include that information as well. Organizing this information in advance helps investigators determine which exchange or business operator to seek records from, and what specifically to request. At Decent Law Firm, after organizing the facts of the incident and the asset movement history, we help specify the exchange accounts, access logs, authentication records, and wallet addresses that investigators will need to confirm during a criminal complaint or report. Even after an investigation begins, if new wallet addresses or signs of exchange inflow are identified, they should be organized as additional evidence and submitted. 6. Frequently Asked Questions (FAQ) Q1. My coins were moved to another wallet through hacking — can the transaction be reversed? Once a transfer is recorded on the blockchain, it is generally very difficult to reverse it the way you might cancel a bank transfer. So rather than trying to cancel the transaction itself, it is more important to identify the current location of the stolen assets and their transaction path, and check whether they have since flowed into an exchange. Q2. If the stolen coins moved to an overseas exchange, does that mean recovery is impossible? The mere fact that the assets moved to an overseas exchange does not mean recovery is impossible. That said, the required procedure and its difficulty can vary depending on the exchange's home country and policies, whether it holds user identity information, the current status of the assets, and the likelihood of cooperation with Korean investigating authorities. Q3. Should I immediately reset a phone or computer that was hacked? Taking steps to prevent further damage is necessary, but resetting the device unconditionally before all the case evidence has been secured requires caution. The affected device may still contain access logs, phishing URLs, malware, and other data showing how the breach occurred, so it is worth preserving the necessary evidence first before proceeding with safety measures. 7. Summary and Key Points If you experience a crypto hacking incident, the first priority is to stop any further withdrawals and secure evidence — TXIDs, wallet addresses, login and authentication records — that can help establish what happened. If the crypto assets have already moved to an external wallet, you should trace the path from the original fraudulent transaction onward, and where there are signs the assets flowed into a specific exchange, consider pursuing evidence preservation and a potential freeze through the investigating authorities. If the cause of the loss appears related to the exchange's own authentication or custody systems, it is also worth examining the exchange's legal obligations and the possibility of a damages claim. At Decent Law Firm, we review the transaction history, TXIDs, wallet addresses, and exchange usage records to reconstruct how the incident occurred and how the assets moved, and help build out the facts and evidence needed for a police report or criminal complaint. Where the stolen assets show signs of moving through domestic or overseas exchanges, we also look at the possibility of requesting evidence preservation or a freeze from the exchange, along with further steps through the investigating authorities, and where the incident relates to the exchange's security or custody obligations, we consider the full path toward recovery, including a damages claim. Because crypto assets can move through multiple wallets and exchanges in a very short time, once you confirm a loss, the priority is to organize whatever evidence you can secure right now, and to get help from a professional as soon as possible so you have the best chance of recovering your lost funds.
-
Foreign Trade Act Violations: When Rerouting Used Car Exports to Russia Becomes a Legal Problem, and How to Respond
1. Why Does Exporting Used Cars to Russia Raise Legal Issues? Not all used-car exports bound for Russia are uniformly prohibited, but a significant number of vehicles currently fall under situational licensing requirements, so item-by-item verification is necessary. Under Article 19-3 of the Foreign Trade Act, even goods that are not strategic items must obtain a situational license if there are certain grounds to believe they may be used or diverted for the manufacture, development, use, or storage of weapons of mass destruction and their delivery systems. Here, "strategic items" refers to goods and technologies separately designated as subject to export controls for the sake of international peace and national security. The law also identifies circumstances that must be checked in connection with situational licensing, such as when the price or payment terms fall outside the normal range, when the transport route is abnormal, or when it is unclear whether the goods will be used in the importing country or re-exported. [Foreign Trade Act Article 19-3 – Situational Licensing] This situational licensing system is also significant for export controls on Russia and Belarus, because a separate list of items subject to situational licensing currently applies specifically to those two countries. In February 2024, the criteria for situational licensing on automobiles exported to Russia were tightened, bringing passenger vehicles with an engine displacement over 2,000cc, among others, within scope. The current list of covered items includes a wide range of vehicles depending on their power source and HS code. The Korea Customs Service has likewise identified illegal exports of vehicles over 2,000cc to Russia as a key enforcement target. Korea's Trade Security Management Agency has also advised that exports of items subject to situational licensing for Russia and Belarus are prohibited in principle, and that a license is granted only after review in limited exceptional cases. Therefore, in an actual export transaction, the HS code, engine displacement, vehicle type, and detailed specifications of each vehicle must be individually checked against the notice that was in effect at the time of that export. 2. Does Exporting to Kyrgyzstan Avoid a Foreign Trade Act Violation? The mere fact that a vehicle was exported to Kyrgyzstan or Kazakhstan does not, by itself, constitute a violation of the Foreign Trade Act. Conversely, simply changing the destination stated on the export declaration to a third country does not allow an exporter to avoid Russia-related export controls, either. If a local Kyrgyz company genuinely purchased the vehicle for use within that country, this legitimate transaction must be distinguished from a circumvention export to Russia. However, the conclusion may differ if the actual Russian buyer was already determined from the outset of the deal, or if the exporter knew that the vehicle was to be moved on to Russia through a third-country intermediary. In March 2026, the Korea Customs Service disclosed, as a major type of detected violation, cases in which exporters declared vehicles as being exported to countries neighboring Russia such as Kazakhstan and Kyrgyzstan, but then actually brought the vehicles into Russia. The Customs Service also stated that, in addition to this method, it detected cases where vehicles over 2,000cc were falsely declared as being 2,000cc or under, and cases where new vehicles intended for the domestic market were disguised as used cars and declared as being exported to a third country. Accordingly, in an actual investigation, the key issue may not be limited to the destination country stated on the export declaration; the vehicle's actual final destination, judged from the transaction as a whole, can become the central point of contention. Key Points to Check When Assessing a Possible Circumvention Export to Russia Item to Check Key Points for Review Destination on the export declaration Whether the declared country matches the actual final destination Overseas buyer Whether the third-country company was the real buyer or merely an intermediary End user Who was actually intended to use the vehicle Contract, invoice, and B/L Whether the transaction structure on paper matches the actual transaction Vehicle's transport route Whether the vehicle moved on to Russia after arriving in the third country Transaction-related communications Whether there were communications about shipment to Russia or a Russian buyer Flow of funds Whether the contractual buyer matches the party that actually paid Ultimately, the mere fact that a transaction passed through a third country cannot, on its own, determine whether it was unlawful. It must be specifically determined whether the deal was a genuine third-country transaction or a structure designed to evade Russia-related export controls. 3. How Do Investigative Authorities Determine Whether a Circumvention Export Occurred? Customs and investigative authorities do not rely on a single export declaration alone. They may also review a range of other materials that can reveal the vehicle's actual movement and the structure of the transaction. The Korea Customs Service has stated that it currently uses AI and big data, based on export declaration records and cargo information, to identify companies at high risk of illegally exporting vehicles to Russia, and that it is strengthening cooperation between its dedicated trade-security investigation unit and other relevant agencies such as the Ministry of Trade, Industry and Energy. Therefore, once an investigation begins, the authorities can confirm the actual transaction structure and final destination through materials such as the following. Export declaration certificates for each vehicle Sales contracts and invoices Bills of lading and other shipping documents Emails and messenger records exchanged with overseas buyers Records of the vehicle's shipment and movement Records relating to the overseas buyer and final consignee Domestic and international remittance and payment records Transaction data stored on mobile phones and work computers In particular, even if the export declaration listed the transaction as being with Kyrgyzstan or Kazakhstan, if other materials show that the price was negotiated directly with a Russian buyer, or that shipment and transport were discussed on the premise of arrival in Russia, the investigative authorities may challenge the actual transaction structure. Conversely, if the vehicle was genuinely sold to an independent third-country company and the exporter was not aware, at the time of export, that it would be re-exported to Russia, it is necessary to organize the contractual relationships and transaction records that support this. In actual legal determinations as well, specific transactional circumstances — such as the transport route, price and payment terms, and whether the goods were used in or re-exported from the importing country — play an important role. Therefore, rather than simply explaining during an investigation that "I didn't know it was going to Russia," it is necessary first to examine what the contracts, communications, and flow of funds from that time actually show about the transaction. 4. What Penalties Can Apply If a Foreign Trade Act Violation Is Detected? Exporting or filing an export declaration for an item subject to situational licensing without obtaining that license can be subject to criminal punishment. Under the current Foreign Trade Act, Article 53(2) provides that a person who exports or files an export declaration for an item subject to situational licensing under Article 19-3 without obtaining that license shall be punished by imprisonment for up to five years or a fine of up to three times the value of the exported goods. [Foreign Trade Act Article 53 – Penalty Provisions] In addition, if a person exports an unlicensed item subject to situational licensing with the intent to promote the international proliferation of strategic items, imprisonment for up to seven years or a fine of up to five times the value of the goods may apply under Article 53(1) of the same Act. However, the seven-year imprisonment provision does not automatically apply to every Foreign Trade Act violation case. It must be separately confirmed whether the requirements of that specific provision are met, such as whether there was intent to promote international proliferation. Furthermore, if a person files an export declaration and actually exports goods without having obtained the required situational license, the offense of unlawful export under the Customs Act may be at issue together with the Foreign Trade Act violation. Article 270(3) of the Customs Act punishes exporting goods without satisfying the licensing or other conditions required by law, or satisfying those conditions through fraudulent means. [Customs Act Article 270] Therefore, when assessing the possibility of punishment, it is necessary to look not only at the export value, but also at whether the vehicle was subject to situational licensing at the time of export, who the actual buyer was and what the final destination was, and how the exporting company perceived these facts. 5. What Should You Do If You Have Already Exported, or Have Been Contacted by Customs or the Police? If an investigation has already begun, the first step is to identify the vehicles at issue and organize, vehicle by vehicle, the regulations that applied at the time of each transaction along with the actual transaction structure. It is advisable to organize the materials in the following order. ① First, identify the vehicles at issue Based on the export declaration certificate, organize information such as the vehicle registration number, vehicle type, engine displacement, HS code, export date, and destination country. Even vehicles exported by the same company cannot automatically be assumed to be subject to the same regulations, so each vehicle needs to be reviewed individually. ② Confirm the situational licensing rules that applied at the time of export The list of items subject to Russia-related situational licensing has been expanded several times. Current standards should therefore not be applied retroactively to past exports; whether an item is covered must instead be checked against the Public Notice on the Export and Import of Strategic Items that was in effect on the actual export date of each vehicle. ③ Organize the actual transactional relationship with the third-country buyer You should confirm who the buyer was under the contract, who actually paid for the vehicle, and whether the third-country company is a genuinely operating business. In particular, if the issue is whether the overseas counterparty merely served as a paper consignee, it is necessary to secure materials that can demonstrate the actual transaction. ④ Review communications and shipping records from the time of the transaction Rather than arbitrarily deleting or altering KakaoTalk, Telegram, WhatsApp, or email records, it is important to preserve them so that the circumstances of the transaction at the time can be verified. Invoices, bills of lading, and shipping records should also be organized together. ⑤ Organize the facts for each vehicle before questioning When multiple transactions are at issue, giving statements without distinguishing the transaction history of each individual vehicle can result in explanations that differ from what actually happened. Therefore, before questioning, you should at least separately organize, for each vehicle, whether it was subject to regulation, the buyer, the party who paid, the destination country, its subsequent travel route, and related communications. If you have already received a summons from customs or the police, or a search and seizure has taken place, you should not merely prepare an explanation that you "exported normally to Kyrgyzstan." Instead, you should first review which aspects are likely to become contested issues between the materials the investigative authorities have obtained and the actual transaction structure. 6. Frequently Asked Questions (FAQ) Q1. If a vehicle exported to Kyrgyzstan later ends up in Russia, will I automatically be punished? Not necessarily. A case in which the vehicle was genuinely sold to a Kyrgyz company that later resold it to Russia on its own initiative must be distinguished from a case in which the transaction was routed through Kyrgyzstan from the outset on the premise that it would be sold to Russia. Both the exporter's understanding of the final destination and the actual transaction structure must be examined together. Q2. Customs hasn't contacted me yet — can I review my past transactions in advance? Yes, you can. In particular, if you are continuing to export used cars to countries neighboring Russia, it is advisable to check in advance which vehicles in your past transactions were subject to situational licensing, and whether your end-user verification and transaction documentation are sufficient. For transactions currently in progress, it is necessary to confirm the item classification and whether a situational license is required before export. Q3. After a search and seizure, what should I do first? You should first check the alleged offenses and items listed in the warrant, as well as the materials actually seized. After that, you need to identify the vehicles and transactions at issue and compare the materials obtained by the investigative authorities with what actually happened, in order to organize your approach to giving statements before questioning. 7. Summary and Key Takeaways The mere fact that a vehicle was exported to a country neighboring Russia does not, by itself, establish a violation of the Foreign Trade Act. However, if a third country was used from the outset merely as a nominal destination on the premise that the goods would ultimately go to Russia, the investigation may extend beyond the contents of the export declaration to cover the actual buyer, the final destination, the flow of funds, and the entire transaction process. In these cases, it is important to review, vehicle by vehicle, both the regulations that applied at the time of export and the actual transaction structure. In particular, if you are facing an upcoming customs or police investigation, you should first organize how your contracts, invoices, shipping records, payment records, and messenger communications connect to the actual transaction. Decent Law Firm reviews all of these factors together — whether the vehicles at issue were subject to situational licensing, the actual transaction structure, the exporter's awareness of the final destination, and the materials obtained by the investigative authorities — to promptly work out a response strategy. If you have already received a summons to appear or a search and seizure has taken place, we recommend seeking professional assistance before your first round of questioning to organize the specific facts and prepare your response.
-
Stock Signal Group Fraud in Korea: A Guide From Reporting to Recovering Your Losses
1. When Can Losses From a Stock Signal Group Be Considered Fraud? If the operator of a stock "signal group" deceived investors with lies or fabricated materials to make them hand over money, this may constitute fraud. Article 347 of Korea's Criminal Act punishes deceiving a person to obtain property or a property-related benefit as fraud. The current statutory penalty for fraud is imprisonment for up to 20 years or a fine of up to KRW 50 million. This penalty was increased by an amendment that took effect on December 23, 2025. What matters, however, is not simply that the investment result was poor, but whether there was deception in the process that led the victim to pay money. For example, the following circumstances warrant a closer look at the underlying facts. Claiming to represent an expert or company that does not actually exist Presenting fabricated account returns or trading records Promising to guarantee the principal or a fixed return despite the possibility of loss Receiving money in the name of investment funds without actually investing it Demanding additional deposits under pretexts such as taxes, security deposits, or fees when withdrawal is requested Giving an explanation about the use of the funds or the transaction structure that differs from the truth In particular, if a person received investment funds while having no intention or ability from the outset to provide a legitimate investment service, whether fraud is established can be examined more actively. If the amount gained through the crime is KRW 500 million or more, aggravated punishment under the Act on the Aggravated Punishment of Specific Economic Crimes may also be examined. However, how to calculate the damages of multiple victims can vary depending on the structure of the offense and the relationships among co-offenders. 2. Does Every Investment Loss in Stocks Mean Fraud? No. The mere fact that a loss occurred due to normal market fluctuations during an otherwise legitimate investment does not establish fraud. Because stock prices inherently carry the possibility of fluctuation, it is difficult to punish an operator for fraud simply because a recommended stock fell in price or an expected return was not achieved. Therefore, in the investigation process, what explanation the investor received before paying money or purchasing stock is generally the key point of review. Key checkpoints for distinguishing fraud from a simple loss Category What to check Evidence worth securing Likely a simple investment loss Stock was actually purchased normally, and the loss occurred from market fluctuation Securities account transaction history, recommendation messages False representation of returns Fake profit verification or manipulated account screens presented Advertisement screenshots, profit-verification images Guarantee of principal or profit Explanation that "there is no loss" or "the return is guaranteed" KakaoTalk/Telegram conversations, recordings Inducement of additional deposits Additional remittances demanded citing withdrawal, taxes, deposits, etc. Remittance records, withdrawal-request conversations False use of investment funds Money was said to be invested but was actually used for other purposes Account transfer records, contracts Individualized investment instructions Specific stocks, prices, and buy/sell timing continuously instructed for the individual 1:1 consultation records, paid chat room conversations Ultimately, what matters more than the size of the loss is whether the explanation that led to the investment decision was true. In particular, if you were told things such as "insider information available only to VIPs," "a stock confirmed to list soon," or "the company guarantees the principal," you should check whether there was any actual basis for such claims. 3. Even If It Is Not Fraud, Could It Violate the Capital Markets Act? Yes. Depending on how the stock signal group is operated, a violation of the Capital Markets Act may be at issue separately from fraud. The Financial Investment Services and Capital Markets Act currently defines as a "quasi-investment advisory business" the business of providing, for consideration from customers, non-individualized advice on investment judgments or the value of financial investment products through publications, broadcasts, or other communication media. On the other hand, if advice on investment judgment is provided individually, reflecting an investor's financial situation or investment objectives, this may fall under the "investment advisory business." In connection with a system implemented from August 14, 2024, Korea's Financial Services Commission has announced that providing investment advice to paying members through two-way channels such as SNS or open chat rooms may be subject to regulation as an investment advisory business. Operating an investment advisory business without registration may raise issues of imprisonment for up to 3 years or a fine of up to KRW 100 million under Articles 17 and 445 of the Capital Markets Act. In addition, Article 101-2 of the Capital Markets Act currently prohibits quasi-investment advisory businesses from the following types of advertising. Advertising that could be mistaken for that of a financial company Advertising that could be mistaken as guaranteeing against loss or guaranteeing profit Advertising presenting a rate of return that is false or has not actually been realized This is a currently effective regulation. Therefore, the mere fact that an operator reported itself to the financial authorities as a quasi-investment advisory business does not mean that all of its business practices are automatically lawful. 4. If I File a Criminal Complaint, Can I Get My Money Back? Filing a criminal complaint alone does not automatically result in the return of the money you lost. Criminal procedure is a process for determining whether the offender's crime is established and for imposing punishment. Therefore, even if the investigative agency recognizes the fraud charge, if the offender has no assets, there may be real difficulty in recovering the lost funds. To recover the lost funds, the following methods can be considered together with the criminal procedure. ① Civil claim for damages Under Article 750 of the Civil Act, a person can claim damages from someone who caused harm through an intentional or negligent unlawful act. ② Provisional attachment If you have identified specific assets of the offender, such as a bank account or real estate, a provisional attachment before filing the main lawsuit can be considered. Article 276 of the Civil Execution Act recognizes provisional attachment as a way to preserve future compulsory execution of monetary claims and the like. However, obtaining a provisional attachment requires substantiating the underlying claim and the necessity of preservation. ③ Order for restitution at the criminal trial stage If a fraud case is prosecuted, filing for an order for restitution during the criminal trial can also be considered. Once an order for restitution is finalized, the certified copy of the guilty judgment may carry the same effect as a certified copy of a civil judgment with executory force for purposes of compulsory execution. However, if the amount of damages or the scope of liability is unclear, the court may dismiss the application for restitution. Recovering the lost funds therefore requires looking not only at whether to file a complaint, but also at the offender's personal details and assets, the remittance route, and the stage of the criminal case. 5. What Should I Prepare Before Reporting a Stock Signal Group Scam? The first thing to do is to secure the relevant materials before leaving the signal group chat room or deleting the conversation. Stock signal group cases often involve advertising, consultation, and deposits all taking place online, so posts may be deleted or the operator may switch accounts as time passes. It is advisable to organize the following materials in their original form as much as possible. 1) Keep the entire chat history of the signal group Rather than picking out only the stock recommendation messages from KakaoTalk, Telegram, or text messages, secure the entire flow from the inducement to join through the request for investment and withdrawal. 2) Capture the advertisements and return-rate materials Keep the advertisements you saw when you joined, such as promises of a guaranteed principal, guaranteed returns, expert credentials, and successful investment cases. 3) Organize the deposit and transaction records Organize, in chronological order, who you sent money to, which account it went to, and how much. If you actually purchased stock through a securities account, prepare that transaction history as well. 4) Secure information about the operator and the business Secure the trade name, the representative's name, the phone number, the account holder's name, the website address, the business registration number, and any SNS accounts used. 5) Write out the timeline of the harm Organizing the sequence of events — the date you first saw the advertisement → joining → the explanation given → the initial deposit → additional deposits → the demand for withdrawal → loss of contact — helps you explain the facts of the complaint more clearly. 6) Keep other victims' materials separate from your own account of the facts Even where other victims of the same signal group are identified, the amount deposited and the explanations given may differ from victim to victim. You should keep what you personally experienced separate from other victims' materials. If you realized you had been victimized right after sending money, it is advisable to contact your financial institution and the investigative agency promptly to check whether any action can be taken on that transaction. However, an immediate account freeze is not possible in every stock signal group case, so the specific remittance method and type of crime involved should be checked separately. 6. Frequently Asked Questions (FAQ) Q1. The stock signal group said the principal was guaranteed, but I incurred a loss. Is that automatically fraud? A promise to guarantee the principal can be an important piece of evidence, but that alone does not conclusively establish fraud. It is necessary to comprehensively check whether there was actually an intention and ability to cover the loss at the time of the promise, whether false returns or false information were presented along with it, and whether the investor paid money in reliance on that explanation. Because the Capital Markets Act also regulates loss compensation and profit guarantees by quasi-investment advisory businesses, an issue under the Capital Markets Act can be examined separately from criminal fraud. Q2. If the investment advisory firm is unregistered, is the contract automatically void and can I get a full refund? The mere fact that a firm is unregistered does not mean the entire contract automatically becomes void. Korea's Supreme Court has held that a violation of the prohibition on operating an unregistered investment advisory business under Article 17 of the Capital Markets Act does not, by itself, mean that the private-law effect of the investment advisory contract is immediately negated. Q3. If the signal group has already been deleted and I cannot reach the operator, is it difficult to report? The fact that some materials have disappeared does not mean that reporting itself is impossible. You should first secure whatever materials remain, such as account transfer records, text messages, existing screenshots, card payment records, and the other party's phone number and account holder's name. In particular, since the account holder and the actual signal group operator may be different people, it is important to organize the flow of funds and the role of each party involved. 7. Summary and Points to Note The mere fact that a loss occurred in a stock signal group does not by itself establish fraud. Whether there was a false explanation at the time of joining or investing, whether money was paid in reliance on that explanation, and how the operator actually used the funds are the key factors for judgment. If you suspect you have been victimized, rather than simply contacting the operator repeatedly, you should first preserve the chat history, advertising materials, remittance records, and a timeline of what happened. Decent Law Firm reviews the circumstances of joining, the process of inducement to invest, the flow of funds, and the operator's explanatory materials in stock signal group cases to identify the applicable issues, such as fraud and violations of the Capital Markets Act. In addition to filing a criminal complaint, when the other party's assets can be identified, we review procedures for recovering the lost funds — such as provisional attachment, a civil claim for damages, and an order for restitution — and guide clients toward a response strategy suited to the stage of their case.
-
Unregistered Virtual Asset Service Providers in Korea: Registration Requirements and Penalties
Frequent trading of virtual assets does not, by itself, mean that you are required to register as a Virtual Asset Service Provider (VASP) in Korea. However, if you repeatedly buy, sell, exchange, transfer, broker, arrange, or facilitate virtual asset transactions for others and receive compensation for doing so, you may be considered a VASP subject to registration requirements under Korea’s Act on Reporting and Using Specified Financial Transaction Information (the “Specified Financial Information Act”). 1. What Is an Unregistered Virtual Asset Service Provider in Korea? A person or entity may be treated as an unregistered VASP if it conducts regulated virtual asset activities as a business without completing the required registration with the Korea Financial Intelligence Unit (KoFIU). The Specified Financial Information Act regulates businesses engaged in activities involving virtual assets, including the purchase and sale of virtual assets, exchanges between virtual assets, certain transfers, custody or management, and the brokerage, arrangement, or agency of virtual asset transactions. Accordingly, the rules are not limited to large centralized exchanges. Depending on the actual structure of the business, an individual or smaller operator may also fall within the scope of a VASP. Specified Financial Information Act, Article 7 ↗ 2. How Is VASP Status Determined? The key issue is not simply whether virtual assets were traded, but whether the relevant activities were carried out “as a business.” The Supreme Court of Korea has held that VASP status should be determined by considering the circumstances as a whole, including: the purpose and type of the transactions; the scale and frequency of the transactions; the period over which the transactions were conducted; and the manner in which the transactions were carried out. In particular, an ordinary exchange user who repeatedly buys or exchanges virtual assets solely for his or her own account and benefit will generally not be regarded as a VASP, absent special circumstances. By contrast, a person who repeatedly conducts virtual asset transactions for the benefit of an unspecified number of customers or users and receives compensation in return may, in principle, be regarded as a VASP. Supreme Court Decision 2024Do10710, Dec. 12, 2024 ↗ 3. How Are Personal Crypto Trading and VASP Activities Distinguished? The amount or frequency of trading is not the decisive factor. What matters more is for whom the transactions are conducted and how the business operates. Factor More Likely to Be Personal Trading May Require VASP Review Purpose Personal investment or profit Providing transaction services to customers Funds Trader’s own funds Funds connected to customers or third parties Counterparty Trading through an exchange for one’s own account Transactions involving multiple customers Compensation No separate fee Fees, spreads, or other compensation received Transaction method Trading based on one’s own decisions Buying, selling, exchanging, or transferring at a customer’s request Continuity Trading as part of personal investment activity Activities performed repeatedly as a business A high transaction volume or a large number of trades does not automatically make a person an unregistered VASP. Conversely, even if transactions are conducted through a personal bank account or wallet, VASP status may need to be reviewed where the person repeatedly provides transaction services to customers and earns fees or other compensation. 4. Can OTC, P2P, or Crypto Transaction Services Require VASP Registration? Yes. OTC or P2P transactions are not automatically subject to VASP registration, but the actual business model may fall within the regulated scope. For example, VASP issues may arise where an operator repeatedly: receives Korean won from customers and transfers USDT or other virtual assets in return; buys, sells, or exchanges virtual assets at a customer’s request; earns fees or profits through transaction spreads; or solicits customers through Telegram, open chat rooms, or similar online channels. The absence of a formal exchange platform or physical business location does not, by itself, exclude the activity from VASP regulation. In June 2026, KoFIU specifically identified private exchange operators that buy and sell stablecoins and other virtual assets in exchange for fiat currency as a type of unregistered virtual asset business activity requiring regulatory attention. KoFIU / Financial Services Commission – Official Source ↗ 5. Can an Overseas Virtual Asset Business Be Required to Register in Korea? Yes. An overseas business may be subject to Korean VASP registration requirements if it conducts business activities targeting users in Korea. KoFIU considers various factors when assessing whether an overseas virtual asset business is conducting business in Korea, including: whether a Korean-language website or service is provided; whether payments in Korean won are supported; whether customer acquisition campaigns target Korean users; and whether marketing activities are directed at users in Korea. In June 2026, KoFIU announced that it had identified eight illegal OTC operators and four overseas exchanges conducting business in Korea, referred the cases to the police, and requested domestic access restrictions for the relevant websites and applications. Accordingly, the fact that a company is incorporated or headquartered outside Korea does not, by itself, exempt it from Korean VASP regulations. KoFIU / Financial Services Commission – Official Source ↗ 6. What Are the Consequences of Operating as an Unregistered VASP? Operating a virtual asset business without the required registration may result in criminal liability under the Specified Financial Information Act. Under Article 17(1) of the Act, a person who conducts virtual asset transactions as a business without filing the registration required under Article 7(1) may be subject to imprisonment for up to five years or a fine of up to KRW 50 million. Specified Financial Information Act, Article 17(1) ↗ In addition, amendments to the Specified Financial Information Act scheduled to take effect on August 20, 2026 will strengthen the entry and registration requirements applicable to VASPs. The amended framework expands the review of matters such as the financial condition and social credibility of the VASP and its major shareholders, as well as organizational, personnel, IT infrastructure, and internal control requirements. Financial Services Commission – Official Source ↗ KoFIU has also taken measures against unregistered operators, including referrals to investigative authorities, requests to restrict domestic access to websites and mobile applications, and restrictions involving transactions with registered VASPs. KoFIU / Financial Services Commission – Official Source ↗ If you have already conducted transactions that may fall within the scope of VASP activities, it is advisable to organize the relevant transaction records, bank account and wallet flows, communications with customers, fee or spread structures, and the specific role you performed before assessing the applicable regulatory and legal risks. 7. Frequently Asked Questions (FAQ) Q1. If I frequently buy and sell USDT, am I automatically considered a VASP? No. Frequent trading alone does not automatically make you a VASP. It is necessary to consider whether you were trading with your own funds for your own benefit or conducting transactions for customers in return for fees or other compensation. Q2. Do I need to register if I occasionally buy crypto on behalf of a friend? Not necessarily. An isolated transaction performed at the request of a friend does not, by itself, determine VASP status. The analysis may change depending on factors such as the number and range of counterparties, transaction frequency and duration, whether compensation was received, and whether the activity was carried out continuously or repeatedly. Q3. Am I outside the VASP rules if I do not have a registered business? No. The absence of a Korean business registration does not, by itself, determine whether you are a VASP under the Specified Financial Information Act. Even an individual operating through a personal account or wallet may need to consider VASP registration requirements if the person repeatedly provides virtual asset-related services to customers for profit. 8. Key Takeaways Whether a person or business constitutes an unregistered VASP in Korea depends not simply on the volume of crypto trading, but primarily on whether virtual asset-related services are repeatedly provided to customers as a business. For OTC, P2P, or transaction-facilitation arrangements in particular, the purpose of the transactions, counterparties, flow of funds, fee structure, and the operator’s actual role should be reviewed together. Decent Law Firm advises clients on whether their virtual asset business models fall within Korea’s VASP regulatory framework, including registration requirements under the Specified Financial Information Act and legal risks associated with unregistered operations.
-
Requirements for False Accusation (Mugo-jwe): Know Them to Prevent Unjust Harm
How Is the Crime of False Accusation Defined Under Korean Law? The requirements for the crime of false accusation are based on Article 156 of the Korean Criminal Act, and the offense is established when a person reports false facts to a public office or official for the purpose of causing another person to be subjected to criminal punishment or disciplinary action. The reported content must be false, differing from the objective facts The reporter must have been aware the report was false and intended for the other party to be punished The report must have been made to a state agency such as an investigative authority The false facts reported must themselves be capable of constituting a criminal offense or grounds for disciplinary action All four of these requirements must be met for the crime of false accusation to be established. Here, awareness need not be definite intent — conditional intent is sufficient — and as for purpose, merely being aware that the other party could be punished is enough; there is no need to actively wish for that outcome. Also, even if the reported facts are false, if they do not themselves constitute a criminal offense or grounds for disciplinary action, false accusation is not established, and the mere fact that a complaint ended in a non-prosecution decision does not automatically mean false accusation has occurred. However, if the reporter genuinely believed the report to be true, false accusation is not established. Here, "genuinely believing it to be true" means that, based on the objective facts known to the reporter, they were not even aware that the reported facts might be false or could be false. This does not apply to a case where the reporter was aware of the possibility of falsity but disregarded it, unconditionally believing their own claim to be correct. From Investigation to Trial: How Does the Process Unfold? Once a false accusation allegation arises, the process typically unfolds as follows. Recognition of the allegation or filing of a complaint - When the original case ends in a non-prosecution decision, the other party may file a counter-complaint, or the investigative authority may launch an ex officio investigation (note: this alone is not a requirement for establishing the offense) Summons for questioning - Securing statements on the circumstances and purpose of the original report Referral to the prosecution and determination of indictment - Reviewing whether the requirements for false accusation are met Trial proceedings - Final sentencing determined in court How the reporter's awareness and purpose at the time of the original report are explained has a decisive impact on the determination of whether the requirements for false accusation are met, so it is important to obtain legal assistance as soon as the allegation becomes known. A Real Case Involving False Accusation [A Case We Handled] Ms. B, a woman in her 40s, filed a complaint against her spouse for assault during divorce proceedings, but the case ended in a non-prosecution decision due to insufficient evidence. Her spouse then filed a counter-complaint for false accusation, and Ms. B visited Decent Law Firm seeking legal assistance. Decent actively demonstrated that there were circumstances at the time of the report that reasonably led Ms. B to believe she had actually been assaulted, and as a result, a determination was reached that the requirements for false accusation were not met. As this shows, because establishing the requirements for false accusation requires closely examining even the reporter's subjective awareness at the time of the report, the initial response can determine the outcome. The Role of Defense Counsel, and Why You Should Work With Decent Cases disputing the requirements for false accusation are an area requiring the following kind of specialized response. Precise analysis of the circumstances and supporting evidence behind the original report Legal defense concerning the determination of falsity and intent Securing the right to defense during questioning and establishing a sentencing strategy Based on our experience handling numerous false accusation cases, Decent closely analyzes each client's situation and carefully reviews whether the requirements for false accusation are met, establishing a systematic defense strategy from the early stages of investigation through trial. False accusation is a representative type of case in which the circumstances and purpose at the time of the report must be accurately explained. If you have already been questioned or are about to be summoned, we recommend consulting first with defense counsel experienced in criminal cases rather than making decisions on your own. Decent Law Firm will always provide prompt and accurate legal consultation to help you find the best direction for your situation.
-
Korea’s Suspicious Account Transaction Freeze System: What Scam Victims and Account Holders Need to Know
Since June 30, 2026, financial institutions in Korea have been able to promptly restrict transactions involving accounts suspected of being used in emerging phishing schemes, including no-show scams and romance scams. Victims should report the incident before the funds are transferred elsewhere. At the same time, an account holder whose account has been frozen despite receiving legitimate payment must be prepared to prove the underlying transaction with objective evidence. What Is the Suspicious Account Transaction Freeze System? Korea’s 「Special Act on the Prevention of Loss Caused by Telecommunications-Based Financial Fraud and Refund for Losses」 provides procedures for freezing accounts used in voice phishing schemes and refunding eligible victims. However, fraudulent schemes disguised as ordinary transactions involving goods or services have generally fallen outside the scope of the conventional voice phishing refund framework. This created practical difficulties in promptly restricting accounts used in scams presented as product purchases, investments, or service transactions. To address this issue, the Financial Services Commission, the Korea Financial Intelligence Unit, and the National Police Agency introduced a system on June 30, 2026, allowing suspicious accounts linked to emerging phishing schemes to be temporarily restricted through existing customer due diligence procedures. Once an account is identified as potentially connected to such a scheme, the financial institution may classify the account holder as subject to enhanced customer due diligence under the 「Act on Reporting and Using Specified Financial Transaction Information」 and restrict incoming and outgoing transactions. What Types of Scams May Be Covered? The system may apply to various forms of emerging phishing fraud, including the following. ▪️No-Show Scams A fraudster impersonates a public institution or corporate buyer, promises a large order, and instructs the victim to purchase goods or materials from a designated supplier. ▪️Romance Scams A fraudster builds a personal relationship through social media or messaging applications and later requests money for investments, business expenses, customs charges, medical costs, or similar reasons. ▪️Investment Scams A fraudster promises profits from stocks, virtual assets, overseas futures, or other investments, receives funds from the victim, and then blocks withdrawals or demands additional payments. However, an account is not automatically frozen simply because money was transferred and a dispute later arose. Authorities must distinguish between an ordinary contractual dispute and conduct involving deception through telecommunications and circumstances indicating possible fraud. Financial institutions and the police may review transaction records, communications, the method used by the suspected offender, and whether the promised goods or services were actually provided. How Does the Transaction Freeze Process Work? 1. Victim Report and Temporary Action by the Financial Institution A person who suspects that they have been targeted by an emerging phishing scam should immediately report the matter by calling 112 or visiting a nearby police station in Korea. A financial institution may take temporary action when it identifies a suspicious transaction through its fraud detection system or receives a report from the victim or the police. The account may therefore be temporarily restricted before the authorities have conclusively determined whether the case involves conventional voice phishing or another form of emerging phishing fraud. 2. Police Review of the Fraud Type The National Police Agency’s Integrated Response Center for Telecommunications Financial Fraud reviews whether the transaction involved a genuine sale of goods or services and examines the specific method used by the suspected offender. When the case is classified as conventional voice phishing, the existing account freeze and victim refund procedures under the telecommunications financial fraud legislation may apply. When the case is classified as an emerging phishing scheme, the relevant account may instead be placed under enhanced customer due diligence procedures. 3. Temporary Transaction Freeze for Seven Business Days Once the account is identified as being connected to an emerging phishing scheme, the financial institution may temporarily restrict both incoming and outgoing transactions. The Korea Financial Intelligence Unit then reviews the transaction history and the relationship between the victim and the account holder within seven business days of receiving the report. 4. Additional Freeze of Up to 60 Business Days When the Korea Financial Intelligence Unit determines that the restriction should remain in place, the financial institution may continue the freeze for an additional 30 business days after the initial seven-business-day period. At the request of the police, the restriction may be extended once for another 30 business days. During this period, the police may investigate the account’s connection to the suspected crime and trace the movement of funds. An Account Freeze Does Not Automatically Guarantee a Refund A suspicious account transaction freeze is intended to prevent funds from being transferred out of an account believed to have been used in a fraudulent scheme. It does not mean that the victim is automatically entitled to an immediate or full refund. In conventional voice phishing cases, the statutory process for extinguishing the account balance and refunding eligible victims may apply. By contrast, a transaction freeze involving an emerging phishing scheme relies on customer due diligence measures under Korea’s financial transaction reporting legislation. It therefore operates differently from the statutory refund process applicable to conventional voice phishing cases. The method and likelihood of recovery may depend on factors including: ▪️The amount remaining in the account ▪️The number of victims ▪️The nature of the suspected fraud ▪️The outcome of the criminal investigation ▪️Whether the account holder or another participant received or transferred the funds Depending on the circumstances, the victim may need to file a criminal complaint and separately consider a civil claim for unjust enrichment or damages against the account holder or the persons who participated in the fraud. Evidence Victims Should Preserve Delays in reporting may allow the funds to be transferred through multiple accounts, converted into cash, or exchanged for virtual assets. Rather than continuing to negotiate with the suspected offender, the victim should first consider reporting the matter and requesting that the relevant account be restricted. Important evidence may include: ▪️Bank transfer receipts, transfer dates, account numbers, and account holder names ▪️Text messages and conversations through KakaoTalk, Telegram, or other messaging services ▪️Screenshots of investment or trading platforms ▪️Requests for additional deposits, fees, or taxes ▪️Contracts, purchase orders, quotations, and business registration information ▪️Telephone numbers, social media accounts, and original files provided by the suspected offender Leaving a chatroom or replacing a mobile phone may make it difficult to preserve the original evidence. Victims should retain not only screenshots but also exported chat records, attachments, and original electronic files where possible. What If a Legitimate Business Account Is Frozen? A business may receive genuine payment for goods or services but still have its account reported as suspicious because the payment is connected to a broader fraudulent fund flow. Even when the underlying transaction was legitimate, restrictions on a business account may significantly affect payroll, supplier payments, and ordinary business operations. The account holder may raise an objection with the relevant financial institution or contact the National Police Agency’s Integrated Response Center for Telecommunications Financial Fraud at 1394. If the police determine that the account is unlikely to be connected to criminal activity, they may request that the financial institution lift the transaction restriction. A general statement that the payment came from a legitimate transaction may not be sufficient. The account holder should provide objective evidence demonstrating the commercial basis for receiving the funds. Relevant materials may include: ▪️Contracts and purchase orders ▪️Tax invoices, receipts, and payment records ▪️Delivery and receipt records ▪️Evidence showing that services were actually performed ▪️Communications with the customer or counterparty ▪️Records showing how the received funds were used ▪️Evidence explaining repeated or similar transactions If the account, debit card, password, or another means of account access was transferred or rented to another person, the matter may go beyond a simple transaction freeze and raise issues under Korea’s Electronic Financial Transactions Act. Similarly, withdrawing cash or transferring funds while knowing that the money was connected to a fraudulent scheme may result in an investigation for aiding and abetting fraud. The account holder should therefore organize the facts and supporting evidence from the earliest stage. Key Points for Responding to a Suspicious Account Freeze Victims of emerging phishing scams should report the incident promptly and preserve all transaction records and communications before the funds are transferred elsewhere. A person or business whose account has been frozen despite receiving legitimate payment should demonstrate the substance of the transaction and the lawful basis for receiving the funds through contracts, invoices, delivery records, and other objective evidence. Decent Law Firm assists clients with criminal complaints arising from emerging phishing scams, reviews potential avenues for recovering transferred funds, and advises account holders on objections to transaction freezes and related criminal investigations. This content is provided for general informational purposes only and does not constitute legal advice for any individual matter.
