We Resolve Legal Matters
How can we assist you?
Blogs
More-
Crypto Hacking Response Guide: What to Do First After You Discover a Breach
1. What Should You Check First When You Discover You've Been Hacked? The first thing to determine is exactly how your crypto assets left your control. Even incidents that look like the same "crypto hacking" can involve very different response strategies and liability structures — a compromised exchange account, a leaked wallet seed phrase, and a fraudulent signature approved on a phishing site are not the same problem. So as soon as you confirm the loss, the first step is to identify which type of incident you are dealing with. Type of Incident What to Check First Immediate Response Exchange account compromised Login history, withdrawal history, whether 2FA settings were changed Request an account/withdrawal freeze Personal wallet compromised Whether the seed phrase or private key was exposed Consider moving remaining assets to a new, secure wallet Phishing site interaction The URL visited, and any signatures or token approvals granted Block further approvals/access and preserve evidence Malware/remote access Installed programs, access and execution logs Stop using the infected device and preserve evidence Exchange-side breach The exchange's incident notice, affected assets, and scope of damage Check the exchange's notice and claims procedure Identifying the type of incident first makes it much easier to determine what evidence to gather and who may ultimately be liable. In particular, if the loss occurred while using an exchange, it is worth checking not only how well you managed your own account, but also whether the exchange was properly safeguarding user assets. Under Article 7 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to keep their own assets separate from user assets and to actually hold the same type and quantity of virtual assets entrusted to them by users. In addition, the current Regulation on Supervision of Virtual Asset Business requires at least 80% of the economic value of user assets to be kept in an environment separated from the internet (cold storage). So if the breach occurred at an exchange, rather than concluding simply that "the account was hacked," it is important to work out exactly how authentication was carried out and which account or wallet the withdrawal came from, since this will affect how liability is ultimately determined. 2. What Should You Do Immediately to Stop Further Losses? Once you confirm the breach, the first priority is to stop any remaining crypto assets from being drained further. If the breach occurred on an exchange account, the first step is to contact the exchange's customer support or incident report channel to check whether login or withdrawals can be restricted. At this stage, don't stop at simply changing your exchange password — check whether other authentication methods, such as your email, phone number, or OTP, may also have been compromised. If the issue originated in a personal wallet, the seed phrase or private key itself may already be exposed. In that case, rather than continuing to use the same wallet, you should consider creating a new wallet in a verified, secure environment and moving any remaining assets there. That said, be careful about immediately resetting a compromised phone or computer. The device may still hold records — phishing site visit history, malware, login logs — that show exactly how the account or wallet was compromised. What to Check Immediately After a Crypto Hacking Incident Request a freeze on further withdrawals from the exchange account Check whether your password, OTP, or other authentication methods were compromised Review protective measures for any remaining crypto assets Avoid resetting the affected device without careful thought Preserve withdrawal alert emails, texts, and app notifications Save your exchange customer support inquiries and their responses What matters at this stage is not rushing into every possible action, but balancing preventing further damage with preserving evidence. At Decent Law Firm, in the initial consultation we first identify the structure of the incident — whether it involves a compromised exchange account, a compromised personal wallet, or phishing/remote access — and based on that, help determine what evidence should be preserved first and what should be requested from the exchange. 3. What Evidence Should You Secure After a Crypto Hacking Incident? Once you've stopped further losses, the next step is to gather as much evidence as possible showing how the stolen assets moved. In crypto cases, what matters most is not just a screenshot of the loss, but the transaction records showing exactly when the assets moved, from which address to which address. Where possible, try to preserve the following information in as close to its original form as possible. Evidence You Should Secure Date and time of the incident Type and quantity of the stolen crypto assets Value of the assets in Korean won at the time of the loss The withdrawal (sending) wallet address The receiving wallet address The TXID or transaction hash The exchange or wallet service used Login and access notifications OTP, phone, and email authentication records Password change notifications Records of exchange customer support inquiries The phishing site URL Related text messages, emails, and messenger conversations Information on any suspicious programs or apps Of these, the TXID and wallet addresses are the core evidence for tracing how the assets moved afterward. On public blockchains, a block explorer can be used to trace how assets moved from the initially compromised address to other addresses. Records kept internally by the exchange also matter. Under Article 9 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to retain transaction records — sufficient to trace, search, and verify transactions — for 15 years from the end of the transactional relationship. However, the fact that an operator retains transaction records is a separate question from whether a victim can immediately obtain all of the internal data they want. Login IP addresses, authentication data, withdrawal approval processes, and other internal system records may not be voluntarily disclosed by the exchange, and may need to be obtained through the proper legal process during an investigation. So before filing a report, it helps to separate what you can gather yourself now from what will need to be obtained later through the investigating authorities. At Decent Law Firm, based on the transaction history, TXIDs, wallet addresses, and exchange responses a victim has secured, we organize a chronological timeline of how the assets moved from the moment of the loss, and structure the facts and evidence so they can be used effectively in a police report or criminal complaint. 4. Can Crypto Assets Already Moved to Another Wallet Still Be Traced or Frozen? Even after crypto assets have moved to another wallet, it is sometimes still possible to trace the transaction path on the blockchain. However, being traceable and being actually recoverable are two different questions. On public blockchains, the transfer from the originally compromised wallet to another wallet remains on the record. So it is possible to check where the stolen assets moved afterward, and whether they show signs of having flowed into a domestic or overseas centralized exchange. In particular, if the assets are confirmed to have moved into a deposit address at an identity-verified centralized exchange, the account information and transaction records held by that exchange can become important evidence for an investigation. Factors to Check When Assessing Recovery Potential Factor What It Means Current custody wallet Whether the stolen assets still remain at that address Inflow to a centralized exchange Whether identity verification may be possible through an exchange account Further movement of assets Whether the assets were quickly split across multiple addresses Change of chain Whether the assets were moved to another network via a bridge Asset conversion Whether the assets were converted into a different crypto asset Use of an overseas operator Whether cooperation from a foreign exchange or international cooperation is needed That said, confirming that assets moved on the blockchain does not mean those assets can be immediately frozen. Reporting and freezing procedures differ from exchange to exchange, and actually freezing assets or obtaining account information may require legal process, such as a request from investigating authorities or a warrant. In addition, if assets have been split across multiple wallets, moved to a different chain, or converted into a different crypto asset, tracing and recovery become considerably more complex. So you should not assume either that "there is a blockchain record, so recovery is guaranteed" or, conversely, that "the assets already moved to another wallet, so recovery is impossible." At Decent Law Firm, based on the secured TXIDs and wallet addresses, we map out how the assets moved, and where there are signs that assets flowed into a specific exchange, we organize the material so that fact is clearly communicated to the investigating authorities. Where an overseas exchange is involved, we also consider that exchange's own damage-reporting and evidence-preservation procedures, along with whether international cooperation through Korean investigating authorities is needed. 5. What Is the Right Order for Filing a Police Report and Seeking Recovery? Once you have organized the facts of the loss and the basic transaction data, the next step is to consider filing a report with the investigating authorities. You can report hacking and other cybercrime damage through the Korean National Police Agency's Cybercrime Reporting System (ECRM), which asks you to specify the date and details of the loss and describe how the crime occurred. In crypto cases, rather than simply stating "my coins were hacked," it is important to organize and submit materials that let investigators immediately understand the structure of the incident. What to Organize Before Filing a Report 1) How the Incident Occurred Note the last time you used the account normally, and when you first noticed the unusual withdrawal. 2) The Assets Affected Summarize the type and quantity of crypto assets involved, and the total loss. 3) The Fraudulent Transaction Confirm the TXID and the sending/receiving wallet addresses. 4) Signs of Account Compromise Note any confirmed signs such as foreign IP access, password changes, OTP changes, or a compromised email account. 5) Movement of the Assets After the Theft If you can confirm the assets moved to another wallet or exchange, include that information as well. Organizing this information in advance helps investigators determine which exchange or business operator to seek records from, and what specifically to request. At Decent Law Firm, after organizing the facts of the incident and the asset movement history, we help specify the exchange accounts, access logs, authentication records, and wallet addresses that investigators will need to confirm during a criminal complaint or report. Even after an investigation begins, if new wallet addresses or signs of exchange inflow are identified, they should be organized as additional evidence and submitted. 6. Frequently Asked Questions (FAQ) Q1. My coins were moved to another wallet through hacking — can the transaction be reversed? Once a transfer is recorded on the blockchain, it is generally very difficult to reverse it the way you might cancel a bank transfer. So rather than trying to cancel the transaction itself, it is more important to identify the current location of the stolen assets and their transaction path, and check whether they have since flowed into an exchange. Q2. If the stolen coins moved to an overseas exchange, does that mean recovery is impossible? The mere fact that the assets moved to an overseas exchange does not mean recovery is impossible. That said, the required procedure and its difficulty can vary depending on the exchange's home country and policies, whether it holds user identity information, the current status of the assets, and the likelihood of cooperation with Korean investigating authorities. Q3. Should I immediately reset a phone or computer that was hacked? Taking steps to prevent further damage is necessary, but resetting the device unconditionally before all the case evidence has been secured requires caution. The affected device may still contain access logs, phishing URLs, malware, and other data showing how the breach occurred, so it is worth preserving the necessary evidence first before proceeding with safety measures. 7. Summary and Key Points If you experience a crypto hacking incident, the first priority is to stop any further withdrawals and secure evidence — TXIDs, wallet addresses, login and authentication records — that can help establish what happened. If the crypto assets have already moved to an external wallet, you should trace the path from the original fraudulent transaction onward, and where there are signs the assets flowed into a specific exchange, consider pursuing evidence preservation and a potential freeze through the investigating authorities. If the cause of the loss appears related to the exchange's own authentication or custody systems, it is also worth examining the exchange's legal obligations and the possibility of a damages claim. At Decent Law Firm, we review the transaction history, TXIDs, wallet addresses, and exchange usage records to reconstruct how the incident occurred and how the assets moved, and help build out the facts and evidence needed for a police report or criminal complaint. Where the stolen assets show signs of moving through domestic or overseas exchanges, we also look at the possibility of requesting evidence preservation or a freeze from the exchange, along with further steps through the investigating authorities, and where the incident relates to the exchange's security or custody obligations, we consider the full path toward recovery, including a damages claim. Because crypto assets can move through multiple wallets and exchanges in a very short time, once you confirm a loss, the priority is to organize whatever evidence you can secure right now, and to get help from a professional as soon as possible so you have the best chance of recovering your lost funds.
-
Unregistered Virtual Asset Service Providers in Korea: Registration Requirements and Penalties
Frequent trading of virtual assets does not, by itself, mean that you are required to register as a Virtual Asset Service Provider (VASP) in Korea. However, if you repeatedly buy, sell, exchange, transfer, broker, arrange, or facilitate virtual asset transactions for others and receive compensation for doing so, you may be considered a VASP subject to registration requirements under Korea’s Act on Reporting and Using Specified Financial Transaction Information (the “Specified Financial Information Act”). 1. What Is an Unregistered Virtual Asset Service Provider in Korea? A person or entity may be treated as an unregistered VASP if it conducts regulated virtual asset activities as a business without completing the required registration with the Korea Financial Intelligence Unit (KoFIU). The Specified Financial Information Act regulates businesses engaged in activities involving virtual assets, including the purchase and sale of virtual assets, exchanges between virtual assets, certain transfers, custody or management, and the brokerage, arrangement, or agency of virtual asset transactions. Accordingly, the rules are not limited to large centralized exchanges. Depending on the actual structure of the business, an individual or smaller operator may also fall within the scope of a VASP. Specified Financial Information Act, Article 7 ↗ 2. How Is VASP Status Determined? The key issue is not simply whether virtual assets were traded, but whether the relevant activities were carried out “as a business.” The Supreme Court of Korea has held that VASP status should be determined by considering the circumstances as a whole, including: the purpose and type of the transactions; the scale and frequency of the transactions; the period over which the transactions were conducted; and the manner in which the transactions were carried out. In particular, an ordinary exchange user who repeatedly buys or exchanges virtual assets solely for his or her own account and benefit will generally not be regarded as a VASP, absent special circumstances. By contrast, a person who repeatedly conducts virtual asset transactions for the benefit of an unspecified number of customers or users and receives compensation in return may, in principle, be regarded as a VASP. Supreme Court Decision 2024Do10710, Dec. 12, 2024 ↗ 3. How Are Personal Crypto Trading and VASP Activities Distinguished? The amount or frequency of trading is not the decisive factor. What matters more is for whom the transactions are conducted and how the business operates. Factor More Likely to Be Personal Trading May Require VASP Review Purpose Personal investment or profit Providing transaction services to customers Funds Trader’s own funds Funds connected to customers or third parties Counterparty Trading through an exchange for one’s own account Transactions involving multiple customers Compensation No separate fee Fees, spreads, or other compensation received Transaction method Trading based on one’s own decisions Buying, selling, exchanging, or transferring at a customer’s request Continuity Trading as part of personal investment activity Activities performed repeatedly as a business A high transaction volume or a large number of trades does not automatically make a person an unregistered VASP. Conversely, even if transactions are conducted through a personal bank account or wallet, VASP status may need to be reviewed where the person repeatedly provides transaction services to customers and earns fees or other compensation. 4. Can OTC, P2P, or Crypto Transaction Services Require VASP Registration? Yes. OTC or P2P transactions are not automatically subject to VASP registration, but the actual business model may fall within the regulated scope. For example, VASP issues may arise where an operator repeatedly: receives Korean won from customers and transfers USDT or other virtual assets in return; buys, sells, or exchanges virtual assets at a customer’s request; earns fees or profits through transaction spreads; or solicits customers through Telegram, open chat rooms, or similar online channels. The absence of a formal exchange platform or physical business location does not, by itself, exclude the activity from VASP regulation. In June 2026, KoFIU specifically identified private exchange operators that buy and sell stablecoins and other virtual assets in exchange for fiat currency as a type of unregistered virtual asset business activity requiring regulatory attention. KoFIU / Financial Services Commission – Official Source ↗ 5. Can an Overseas Virtual Asset Business Be Required to Register in Korea? Yes. An overseas business may be subject to Korean VASP registration requirements if it conducts business activities targeting users in Korea. KoFIU considers various factors when assessing whether an overseas virtual asset business is conducting business in Korea, including: whether a Korean-language website or service is provided; whether payments in Korean won are supported; whether customer acquisition campaigns target Korean users; and whether marketing activities are directed at users in Korea. In June 2026, KoFIU announced that it had identified eight illegal OTC operators and four overseas exchanges conducting business in Korea, referred the cases to the police, and requested domestic access restrictions for the relevant websites and applications. Accordingly, the fact that a company is incorporated or headquartered outside Korea does not, by itself, exempt it from Korean VASP regulations. KoFIU / Financial Services Commission – Official Source ↗ 6. What Are the Consequences of Operating as an Unregistered VASP? Operating a virtual asset business without the required registration may result in criminal liability under the Specified Financial Information Act. Under Article 17(1) of the Act, a person who conducts virtual asset transactions as a business without filing the registration required under Article 7(1) may be subject to imprisonment for up to five years or a fine of up to KRW 50 million. Specified Financial Information Act, Article 17(1) ↗ In addition, amendments to the Specified Financial Information Act scheduled to take effect on August 20, 2026 will strengthen the entry and registration requirements applicable to VASPs. The amended framework expands the review of matters such as the financial condition and social credibility of the VASP and its major shareholders, as well as organizational, personnel, IT infrastructure, and internal control requirements. Financial Services Commission – Official Source ↗ KoFIU has also taken measures against unregistered operators, including referrals to investigative authorities, requests to restrict domestic access to websites and mobile applications, and restrictions involving transactions with registered VASPs. KoFIU / Financial Services Commission – Official Source ↗ If you have already conducted transactions that may fall within the scope of VASP activities, it is advisable to organize the relevant transaction records, bank account and wallet flows, communications with customers, fee or spread structures, and the specific role you performed before assessing the applicable regulatory and legal risks. 7. Frequently Asked Questions (FAQ) Q1. If I frequently buy and sell USDT, am I automatically considered a VASP? No. Frequent trading alone does not automatically make you a VASP. It is necessary to consider whether you were trading with your own funds for your own benefit or conducting transactions for customers in return for fees or other compensation. Q2. Do I need to register if I occasionally buy crypto on behalf of a friend? Not necessarily. An isolated transaction performed at the request of a friend does not, by itself, determine VASP status. The analysis may change depending on factors such as the number and range of counterparties, transaction frequency and duration, whether compensation was received, and whether the activity was carried out continuously or repeatedly. Q3. Am I outside the VASP rules if I do not have a registered business? No. The absence of a Korean business registration does not, by itself, determine whether you are a VASP under the Specified Financial Information Act. Even an individual operating through a personal account or wallet may need to consider VASP registration requirements if the person repeatedly provides virtual asset-related services to customers for profit. 8. Key Takeaways Whether a person or business constitutes an unregistered VASP in Korea depends not simply on the volume of crypto trading, but primarily on whether virtual asset-related services are repeatedly provided to customers as a business. For OTC, P2P, or transaction-facilitation arrangements in particular, the purpose of the transactions, counterparties, flow of funds, fee structure, and the operator’s actual role should be reviewed together. Decent Law Firm advises clients on whether their virtual asset business models fall within Korea’s VASP regulatory framework, including registration requirements under the Specified Financial Information Act and legal risks associated with unregistered operations.
-
Crypto Referral Liability in Korea: Why the FSC Issued a Warning on Unregistered Virtual Asset Service Providers
Sharing overseas crypto exchange referral links on YouTube, Telegram, or open chat rooms may seem like simple advertising. However, in its press release dated June 24, 2026, the Financial Services Commission (FSC) stated that referral or recommendation-link activities may be viewed as assisting unregistered virtual asset business operations. The FSC also noted that referrers themselves may be subject to criminal liability depending on the circumstances. If you operate or participate in crypto referral marketing, private stablecoin exchange, or promotion of overseas crypto exchanges targeting Korean users, it is important to review whether your activities may raise issues under Korea’s Specified Financial Information Act. Key Points from the FSC Warning The FSC explained that, under the Specified Financial Information Act, any entity conducting virtual asset business targeting Korean users must be reported to the Korea Financial Intelligence Unit (KoFIU), unless it is one of the 28 registered virtual asset service providers. If an entity conducts virtual asset trading, exchange, transfer, custody, brokerage, or intermediary services as a business without proper reporting, this may constitute a violation of the Specified Financial Information Act. Unregistered virtual asset business activities may be punishable by imprisonment of up to 5 years or a fine of up to KRW 50 million. The FSC also noted that, after the amended Specified Financial Information Act takes effect in August 2026, those involved in unregistered illegal business activities may face additional restrictions. These may include restrictions on becoming a major shareholder of a domestic virtual asset service provider or serving as a representative or executive officer for a certain period. In this sense, the FSC press release is not merely a general user warning. It can also be understood as a signal that Korean authorities may strengthen investigations and sanctions against unregistered virtual asset service providers and those who assist their business activities. Three Types of Illegal Activity Highlighted by the FSC The FSC identified three major types of illegal virtual asset business activities recently observed in Korea. First, overseas exchanges conducting business in Korea without reporting. Even if an exchange is based overseas, Korea’s Specified Financial Information Act may apply if the exchange conducts business targeting Korean users. Factors such as Korean-language websites, KRW payment support, Korean user acquisition events, and domestic marketing activities may be considered together. Second, private stablecoin exchange businesses. Private exchange operators who buy, sell, or exchange stablecoins such as USDT for KRW may also raise legal issues. These services may target foreign students, tourists, foreign residents in Korea, or users who wish to avoid identity exposure. Even if the operator claims that the activity was merely a private exchange, it may still be viewed as an unregistered virtual asset business if repetition, fees, customer solicitation, and business structure are confirmed. Third, SNS-based referral promotion. This refers to cases where a person receives commissions from an overseas virtual asset service provider and promotes that exchange through YouTube, Telegram, open chat rooms, or similar channels. In particular, if the promotion is combined with referral links, invitation codes, fee paybacks, VIP chat rooms, or user-management activities, it may go beyond simple advertising and be viewed as user solicitation or assistance to unregistered business operations. Why Crypto Referral Marketing May Become a Criminal Issue Crypto referral programs are commonly operated in the following structure. 1. Distribution of overseas exchange referral links or invitation codes 2. Receipt of commissions based on referred users’ trading volume 3. Guidance on how to use the exchange through Telegram or open chat rooms 4. Promotion based on events, profit claims, fee discounts, or other incentives 5. Repeated promotion targeting Korean users The legal issue is whether this structure is merely advertising or whether it assists an unregistered virtual asset service provider’s business in Korea. In its press release, the FSC specifically warned against participating in referral or recommendation-link solicitation activities and stated that referrers may also be subject to criminal liability. Therefore, YouTubers, influencers, investment chat room operators, Telegram channel operators, and open chat room administrators may be investigated even if they did not directly operate the exchange. Investigators may review how the promotion was conducted, how referral fees were paid, whether there was a contractual relationship with the exchange, and how Korean users were recruited. Can Private Exchange or OTC Transactions Also Lead to Investigation? The same issue may arise in private exchange or OTC transactions. A person may believe that they were simply buying or selling crypto. However, the following circumstances may raise issues under the Specified Financial Information Act. 1. Repeated transactions with an unspecified number of users 2. Receipt of fees or exchange-rate margins for each transaction 3. Customer solicitation through Telegram, KakaoTalk, or SNS 4. Continuous exchange between KRW and stablecoins such as USDT 5. Brokerage or intermediary activity for the convenience of others The Supreme Court of Korea has also held that, unlike an ordinary exchange user, a person may be considered a virtual asset service provider if they continuously and repeatedly conduct virtual asset transactions for the benefit of an unspecified number of customers or users and receive compensation for doing so. The key issue is whether the activity was simple holding or investment, or whether it can be viewed as repeated, compensated virtual asset transactions conducted as a business. Why Ordinary Users Should Not Simply Assume They Are Safe Using an unregistered exchange or private exchange service does not automatically make a user a suspect under the Specified Financial Information Act. However, the FSC has warned that users of illegal virtual asset operators may face unexpected disadvantages. For example, the user’s funds may become mixed with criminal funds, or the user may become subject to investigation during the process of verifying counterparties and the source of funds. The following situations may make it difficult to characterize the person as a mere user. 1. Sharing referral links with acquaintances and receiving rewards 2. Repeatedly encouraging others to use an unregistered exchange 3. Introducing private exchange transactions and receiving commissions 4. Dealing with funds suspected to be connected to phishing, narcotics, fraud, or other crimes 5. Allowing one’s bank account to be used as a deposit or withdrawal channel for multiple people In such cases, authorities may review not only potential violations of the Specified Financial Information Act, but also issues under the Electronic Financial Transactions Act, the Criminal Proceeds Concealment Act, fraud aiding and abetting, or other money-laundering-related allegations. If You Have Already Been Contacted by Investigators If you have been contacted by the police, KoFIU, or another investigative authority, the first step is to accurately identify your role. The defense strategy will differ depending on whether you were a mere user, promoter, broker, intermediary, or private exchange operator. At the early stage of investigation, it is important to organize the following materials. · How you joined or used the exchange · Referral link or referral code usage history · Commission or fee settlement records · Telegram, KakaoTalk, or open chat room messages · Virtual asset deposit and withdrawal records · KRW bank account transaction records · Contracts or settlement records with overseas exchanges or advertisers · Whether you recruited Korean users The important point is not simply to claim that you were only a user. Before making a statement, it is necessary to analyze how investigators may view the transaction structure, revenue structure, promotion method, user recruitment, repetition, compensation, and awareness of illegality. How Decent Law Firm Can Assist Decent Law Firm has reviewed a wide range of matters involving virtual asset service provider reporting, violations of the Specified Financial Information Act, crypto referral marketing, OTC and P2P transactions, stablecoin exchange, and criminal cases involving overseas exchanges. Virtual asset investigations are not limited to crypto transaction records. Investigative authorities may review Telegram messages, referral-fee settlement structures, relationships with exchanges, KRW bank account flows, wallet address movements, advertising phrases, and user recruitment methods. Before attending an investigative interview, the following issues should be carefully reviewed. 1. Whether the activity constitutes a virtual asset business under the Specified Financial Information Act 2. Whether the alleged unregistered business activity had continuity, repetition, and compensation 3. Whether referral promotion was simple advertising or user solicitation 4. Whether private exchange activity was personal trading or business operation 5. Whether the matter may expand into money laundering or criminal proceeds allegations 6. What should and should not be stated during a police interview If you have been contacted by investigators in relation to crypto referrals, private exchange, or use of an unregistered overseas exchange, legal review before your initial statement is essential. Decent Law Firm’s Virtual Asset Practice Group analyzes the transaction structure and investigation issues together to provide a response strategy tailored to each client’s situation. Key Takeaways The FSC press release dated June 24, 2026 is not merely a general warning about unregistered virtual asset service providers. It clearly indicates that overseas exchanges targeting Korean users, private stablecoin exchange operators, and SNS-based crypto referral promoters may all be subject to investigation under the Specified Financial Information Act.In particular, because the FSC officially mentioned that referral participants may also face criminal liability, YouTubers, influencers, channel operators, and investment chat room operators should immediately review their existing promotion structures. After being contacted by investigators, simply saying that you did not know may not be enough. The first step should be to legally assess whether your conduct may be viewed as business operation, brokerage, intermediation, or solicitation under Korean law. Source: Financial Services Commission, Press Release on Caution Against Using and Trading with Illegal Virtual Asset Operators, June 24, 2026. This content is provided for general informational purposes only and does not constitute legal advice for any specific case.
-
Criminal Risks and Terms of Service Issues for Crypto Investment Information Providers in Korea
Criminal Risks in Operating Crypto Investment Information Services As the virtual asset market continues to grow, services such as crypto trading signal rooms, paid investment information memberships, and crypto advisory-style services have become increasingly common in Korea. At the same time, regulatory scrutiny over paid investment information services has been increasing. According to the Financial Supervisory Service’s 2024 inspection results for quasi-investment advisory businesses, violations were found in 112 out of 745 businesses reviewed, including cases involving unregistered investment advisory activities. While these figures do not directly relate only to virtual asset cases, they show that Korean regulators are paying closer attention to paid investment information services in general. In practice, disputes that begin as refund complaints may escalate into criminal complaints involving fraud, violations of the Financial Investment Services and Capital Markets Act, or violations of the Act on Reporting and Using Specified Financial Transaction Information. In these cases, terms of service, contracts, refund policies, and user communications often become key evidence. This article explains the major legal issues that may arise and why terms of service should be reviewed carefully before a dispute develops into a criminal investigation. Key Laws That May Apply Issue Main Legal Point Potential Penalty Fraud Obtaining property or financial benefit through deception Under the current Criminal Act, imprisonment for up to 20 years or a fine of up to KRW 50 million. The applicable law may vary depending on when the alleged conduct occurred. Capital Markets Act Violation Unregistered investment advisory activities may become an issue where the service involves security tokens or is combined with financial investment product advisory services Imprisonment for up to 3 years or a fine of up to KRW 100 million Specified Financial Transaction Information Act Violation Operating as an unregistered virtual asset service provider Imprisonment for up to 5 years or a fine of up to KRW 50 million E-commerce Law Violation Improper restriction of cancellation, withdrawal, or refund rights Administrative fines, corrective orders, or other administrative measures Administrative sanctions and criminal penalties may proceed separately. Depending on the facts, the same business conduct may give rise to more than one legal issue. Why Terms of Service Become Evidence in Criminal Investigations When a refund dispute turns into a criminal complaint, investigators often review the terms of service and user agreements at an early stage. Terms of service can show what kind of service the business claimed to provide, how it explained investment risk and refund conditions, and whether the actual operation matched what was written in the documents. In particular, investigators may compare the terms of service with the actual sales process, user communications, and service operation in the following areas. 1. Fraud and Deceptive Conduct For fraud allegations, investigators do not look only at whether the user suffered a loss. They examine what the business told the user, whether the possibility of loss was clearly explained, whether any statements implied guaranteed profits, and whether the written terms matched the actual service. If the terms of service clearly state that investment losses may occur and that the service does not guarantee profits, and if similar explanations were repeatedly given during consultations or user communications, these records may help dispute allegations of deception. On the other hand, if the terms contain disclaimers but the actual sales process included statements similar to “guaranteed profits,” “loss recovery,” or “risk-free trading,” the inconsistency between the written terms and the actual operation may become unfavorable evidence. 2. Capital Markets Act Issues Capital Markets Act issues do not automatically arise in every crypto investment information case. However, if the relevant virtual asset may be treated as a security token or if the service is connected with stock, derivatives, or other financial investment product advisory services, the operation may be reviewed under the Capital Markets Act. For example, even if the terms describe the service as “general information provided to an unspecified number of users,” the actual operation may still become problematic if it involved one-on-one recommendations, bidirectional paid chat rooms, or personalized investment judgments. In that situation, the terms of service may be compared against how the service was actually operated. 3. Virtual Asset Service Provider Issues Under the Specified Financial Transaction Information Act, a business may be required to register as a virtual asset service provider if it is not merely providing information but is also involved in virtual asset transactions, brokerage, transfer, custody, or management. Even if the terms of service define the business as an information service, the actual operation may be reviewed differently if the company handled user assets, executed trades, assisted repeated transfers, or received fees for transaction-related services. Supreme Court Guidance on Virtual Asset Service Provider Status In a case involving the Specified Financial Transaction Information Act, the Supreme Court of Korea held that a person may generally be regarded as a virtual asset service provider if they continuously and repeatedly conduct virtual asset transactions for the benefit of unspecified customers or users and receive compensation for doing so. This means that the actual substance of the service matters. If the business repeatedly participates in transactions and receives fees, it may be difficult to rely only on written terms stating that the service is limited to information provision. Key Issues to Review at the Early Investigation Stage For operators of crypto investment information services, the early stage of an investigation is critical. The following issues should be reviewed first. First, the consistency between the terms of service and actual operation should be checked. This includes the scope of service, refund conditions, risk disclosure language, and how the service was actually provided to users. Second, businesses should review whether any terms, advertisements, landing pages, chat messages, or sales scripts could be interpreted as guaranteeing profits or compensating losses. Since the 2024 amendments to the Capital Markets Act, restrictions on quasi-investment advisory businesses have been strengthened, including rules related to bidirectional channels and misleading profit-guarantee advertisements. Third, the communication channel should be reviewed. Whether the service was operated as a one-way information channel or as a bidirectional advisory channel may affect the legal assessment. Fourth, the initial statement to investigators should be prepared carefully. If the operator explains the terms inaccurately or gives statements that do not match the actual operation, it may become more difficult to defend the case later. DECENT Law Firm’s Virtual Asset Practice Team Cases involving crypto investment information services often involve multiple legal issues at the same time, including fraud, the Capital Markets Act, the Specified Financial Transaction Information Act, and e-commerce regulations. DECENT Law Firm’s Virtual Asset Practice Team assists clients from the early investigation stage by reviewing terms of service, service operation records, user communications, refund policies, and the legal issues relevant to each allegation. If you have been contacted by Korean investigative authorities, or if a refund dispute may escalate into a criminal complaint, it is important to review your response strategy before the first statement is given. This content is provided for general informational purposes only and does not constitute legal advice for any specific case.
-
Pre-Trial Detention Hearing Strategy in Korea: Why You Need a Criminal Defense Lawyer Immediately
A detention warrant request is not the end of an investigation — in many cases, it is the moment that determines the direction of the entire criminal case. In Korea, once prosecutors request a detention warrant, the court usually conducts a pre-trial detention hearing within approximately 48 hours. What happens during this short window can significantly affect whether the suspect remains free or is taken into custody. Only 48 Hours to Prepare A Korean pre-trial detention hearing (often referred to as a warrant review hearing) is a procedure where a judge directly questions the suspect before deciding whether detention is necessary. Within this limited timeframe, the defense team must quickly: review the investigation status, meet the detained suspect, analyze statements and evidence, prepare written submissions, organize supporting materials, and develop a hearing strategy. In practice, many detention decisions are heavily influenced by the preparation completed before the hearing even begins. What Korean Courts Focus on in Detention Hearings Korean courts generally evaluate three core issues when deciding whether to issue a detention warrant. 1. Risk of Flight The court considers whether the suspect may avoid future investigation or trial proceedings. Stable residence, employment, family ties, and long-term connections to Korea can become important factors supporting release. 2. Risk of Evidence Tampering Judges also examine whether the suspect may destroy evidence, influence witnesses, or coordinate statements with related parties. If major evidence has already been secured and the suspect has cooperated with investigators, these points may help reduce concerns about detention necessity. 3. Seriousness of the Alleged Crime The court reviews the severity of the allegations, potential repeat offenses, financial damage, and overall case structure. At the same time, factors such as victim compensation efforts, settlement discussions, remorse, or legal disputes regarding the allegations may also be considered by the court. A criminal defense lawyer structures the defense strategy around these exact legal standards rather than relying on emotional appeals alone. A Detention Hearing Lawyer Does Much More Than Attend Court Effective defense in detention cases is usually built before the hearing date. ✔️ Immediate Client Interview and Statement Review The lawyer meets the suspect as quickly as possible to understand the case structure, prior statements made to investigators, and any inconsistencies or legal risks that may affect the hearing. ✔️ Written Opinions and Supporting Materials Defense counsel prepares written submissions explaining why detention is unnecessary. These materials may include: proof of residence, employment records, family relationship documents, medical conditions, cooperation history, transaction records, contracts, or communication evidence relevant to the allegations. The quality and organization of these submissions can directly affect the judge’s perception of the case. ✔️ Hearing Preparation and Statement Strategy During the hearing, suspects are questioned directly by the judge. Answers given during this process can significantly influence the outcome. An experienced lawyer helps prepare how key facts should be explained, which issues require caution, and how to maintain a consistent legal position throughout the hearing. ✔️ Planning for Possible Detention Even before the hearing concludes, the defense may also prepare follow-up measures such as detention review requests, bail applications, or additional legal filings if detention is ultimately granted. Early Defense Is Especially Important in Financial and Crypto-Related Cases Cases involving cryptocurrency, investment disputes, fraud allegations, voice phishing, OTC crypto transactions, or financial crimes are often highly technical and document-heavy. Simply claiming innocence is rarely enough. The defense must clearly explain transaction structures, fund flows, business relationships, and the suspect’s actual role in a way the court can realistically understand within a short hearing. In multi-party investigations, statements made by co-defendants or related individuals can also create additional risks at the detention stage. For foreign nationals living in Korea or international business operators, these risks may become even more serious due to language barriers, visa concerns, or misunderstandings regarding Korean criminal procedures. Detention Is Not a Conviction — But It Changes Everything A detention warrant does not mean guilt has been proven. However, actual detention can severely affect: preparation of the defense, business operations, employment, immigration status, family life, and psychological stability. There is a substantial practical difference between defending a criminal case while free and defending it while detained. If you have been contacted by Korean investigators or informed that a detention warrant may be requested, immediate legal review is strongly recommended. The criminal defense team at Decent Law Firm handles detention hearings, financial crime investigations, cryptocurrency-related criminal matters, and complex economic crime cases involving both Korean and foreign clients in Korea. Early action often shapes the outcome.
-
An Arrest Warrant Has Been Requested — What You Must Do Right Now
What Is a Detention Hearing (Pre-Arrest Warrant Review)? A detention hearing in Korea is a court procedure where a judge decides whether a suspect should be detained after a prosecutor files for an arrest warrant. This system was introduced through amendments to the Korean Criminal Procedure Act in 1995 and has been fully implemented since 1997. Its purpose is to ensure that the suspect is given an opportunity to explain their position before being detained. At the hearing, the judge does not determine guilt or innocence. Instead, the judge evaluates whether detention is necessary based on the following factors: Whether the suspect has a stable residence (this includes actual living arrangements, family ties, and employment — not just the registered address) Whether there is a risk of evidence destruction Whether there is a risk of flight In short, the key issue is not “Did the suspect commit the crime?” but rather “Is detention necessary at this stage?” What Happens If the Warrant Is Granted or Denied? Outcome Meaning Next Steps Warrant Denied No detention Investigation and trial proceed while the suspect remains free Warrant Issued Detention in a detention center Investigation and trial proceed while the suspect is in custody Reapplication Prosecutor may refile after supplementing the case Another detention hearing may be held (if the original grounds for denial are not resolved, it may be denied again) If the warrant is denied, the suspect can prepare their defense while remaining at liberty. If the warrant is issued, the suspect will be detained, which significantly restricts both daily life and the ability to prepare a legal defense. This makes the detention hearing a critical turning point in the entire criminal process. The 24-Hour Golden Window — What Your Lawyer Does The period immediately following a warrant request is often referred to as the “golden 24 hours.” During this time, the role of a defense lawyer is crucial. A lawyer does far more than provide general assistance. The goal is to persuasively demonstrate to the court that detention is unnecessary. Key actions include: Quickly analyzing the suspect’s situation and the prosecution’s claims Preparing and submitting a written legal opinion to the court before the hearing Presenting evidence of: Residential stability Employment and family ties Willingness to cooperate with the investigation Lack of risk of evidence destruction Attending the hearing with the suspect and responding directly to the judge’s questions Even with the same allegations, the outcome can vary significantly depending on how the defense is prepared and presented. A detention hearing is not a procedure you should face unprepared. Your Response Starts the Moment You Are Notified Once you are informed that an arrest warrant has been requested, the response must begin immediately. At Decent Law Firm, our criminal defense team provides rapid and strategic support from the moment a warrant request is made — from preparing for the detention hearing to developing a non-custodial defense strategy. Our focus is on: Quickly understanding the facts of the case Identifying the most effective defense approach within a limited timeframe Presenting a structured and persuasive argument to prevent detention If you or someone close to you is facing an arrest warrant request in Korea, seek legal assistance without delay. Time is the most critical factor.
