We Resolve Legal Matters
How can we assist you?
PRACTICES
More-
Crypto
Cryptocurrency, VASP, Coin Exchange, Coin Fraud, Coin Hacking
-
Criminal
Fraud/Embezzlement, Sexual Crime, Drug Crime, Economic Crime, Voice Phishing
-
Corporate & Biz
Startups, Contract Review, Investment Advisory, M&A Advisory, Risk Management
-
Cross-border · Dispute Resolution
International Laws & Regulations, Overseas Company Incorporation, Global Expansion (FLIP), International Investment, International Contracts
-
Civil
Damages, Injunction, Unjust Enrichment, Contract Dispute, Litigation Proxy
-
Class Action
Litigation Representation, Damages Claims, Investment Fraud, Victim Relief, Collective Action
-
Labor · Employment Disputes
Employment Advisory, Serious Accidents Punishment Act, Labor Standards Act, Employment Disputes, Collective Actions
-
Rehabilitation · Bankruptcy
Individual & Corporate Rehabilitation, Bankruptcy, Court Receivership, Debt Relief, Credit Recovery
-
VC · Financial Advisory
VC, IPO, Financial Regulatory Advisory, Internal Control, Legal Due Diligence
-
IP Litigation
Trade Secrets, Intellectual Property, Technology Transfer, R&D, Licensing
-
Divorce · Family
Property Division, Alimony, Mediation, Statutory Share, Inheritance Acceptance
-
Real Estate Disputes · Construction
Leases, Tenancy Disputes, Jeonse Fraud, Sale Agreements, Redevelopment, Permits
-
Administrative
Administrative Orders, Regulatory Dispositions, Administrative Appeals, Licensing & Permits, State Compensation
-
Entertainment
Exclusive Contracts, Contract Termination, Copyright, Publishing, Overseas Expansion
-
Sports
Broadcasting Agreements, Player Contracts, Esports, Sports Agents, International Competitions
LAWYERS
More-
MPHyeonsu “Elliot” Jin
#Cross-border · Dispute Resolution #Crypto #VC · Financial Advisory #IP Litigation #Sports
-
PHokyun “Brad” Lim
#Labor · Employment Disputes #Corporate & Biz #Real Estate Disputes · Construction #VC · Financial Advisory #Cross-border · Dispute Resolution
-
PYoungyoon ”Yoon” Kwak
#Criminal #Civil #Labor · Employment Disputes #Crypto #Cross-border · Dispute Resolution
-
PHongsik ”Mark” Kim
#Criminal #Divorce · Family #Civil #Real Estate Disputes · Construction #VC · Financial Advisory
-
Sunghwan “Sean” Lim
#Civil #Criminal #Crypto #Cross-border · Dispute Resolution #Real Estate Disputes · Construction
-
AJuye ”Elizabeth” Han
#Cross-border · Dispute Resolution #Crypto #VC · Financial Advisory #IP Litigation #Administrative
-
AJinwon “Eric” Park
#Criminal #Civil #Corporate & Biz #Real Estate Disputes · Construction #Administrative #Divorce · Family
-
ABeomhui “Sonny” Won
#Criminal #Civil #Divorce · Family #Real Estate Disputes · Construction #Labor · Employment Disputes #Administrative
-
AHyunsoo “Sue” Rha
#VC · Financial Advisory #IP Litigation #Cross-border · Dispute Resolution #Civil #Administrative
-
ADayoun “Diane” Lee
#Criminal #Civil #Crypto #Corporate & Biz #Cross-border · Dispute Resolution #VC · Financial Advisory
Blogs
More-
Police Request to Appear by Phone in Korea: What to Check Before a Suspect Interview
If you receive a call from the police asking you to appear for questioning, one of the first things to confirm is whether you are being contacted as a criminal suspect or as a witness or other person involved in the case. A police request to appear does not always arrive as a written notice. Under Korea’s current investigation rules, a written request is generally used, but a request may also be made by phone, text message, or another appropriate method where prompt contact is necessary or other circumstances justify doing so. The current rules took effect on July 1, 2026. Rather than ignoring the call or immediately discussing the substance of the case, it is important to first identify the case involved, your procedural status, the investigating officer, and the proposed interview schedule. Can the Police Ask You to Appear by Phone? Yes. A police request to appear may be made by phone or text message in certain circumstances. Article 200 of the Criminal Procedure Act provides the legal basis for requesting a criminal suspect to appear for questioning where necessary for an investigation. The specific method of requesting an appearance is governed by Article 19 of the Regulation on Mutual Cooperation Between Prosecutors and Judicial Police Officers and General Rules for Investigation. As a general rule, a written request stating the purpose of the appearance, including the substance of the suspected offense, should be sent. However, where prompt contact is required or other unavoidable circumstances exist, the request may instead be made by telephone, text message, or another appropriate method. Accordingly, a police call should not be disregarded simply because no written notice has been received. The more important first step is to identify which police station and officer are handling the matter, what case the request concerns, and in what capacity you are being asked to appear. Why Should You First Confirm Whether You Are a Suspect? Because your legal position and the purpose of the interview differ depending on whether you are a suspect or a person being questioned in connection with someone else’s case. A criminal suspect is a person who is under investigation for a suspected criminal offense. Article 200 of the Criminal Procedure Act governs requests for a suspect to appear for questioning. By contrast, Article 221 permits investigators to request the appearance of a person other than the suspect where his or her statement is necessary for an investigation. This may include a victim, witness, or another person connected to the case. The fact that both may receive a call asking them to come to a police station does not mean their procedural positions are the same. If you are being questioned as a suspect, the police may ask questions directly concerning the alleged offense, and statements made during the interview may become important evidence as the investigation proceeds. Before interrogating a suspect, investigators must also inform the suspect of certain rights, including the right to remain silent and the right to assistance of counsel, as provided under Article 244-3 of the Criminal Procedure Act. For this reason, if you receive a request to appear, it is generally advisable to first determine your procedural status and the nature of the case before giving a lengthy explanation of your position over the phone. What Should You Check When the Police Call? After confirming whether you are a suspect, you should identify the basic information necessary to understand and prepare for the investigation. You will not necessarily be given access over the phone to the complainant’s statements, evidence collected by investigators, or the complete investigation record. However, you should generally try to identify the basic circumstances of the request before simply agreeing to an interview date. What to Check Why It Matters Police station, division, and investigating officer Confirms the investigating authority and contact details Whether you are a suspect or another person involved Clarifies your procedural status Case or alleged offense involved Helps identify the subject of the investigation Date, time, and place of interview Allows you to prepare and coordinate your schedule Whether a written request has been or will be sent Allows you to review any information provided in writing If the call itself appears suspicious, you may verify the officer and department through the police station’s official contact information rather than relying solely on the telephone number provided by the caller. Can You Ask to Change the Interview Date? Yes. If you have a legitimate scheduling issue, you may ask the investigating officer to adjust the date and time. Article 19 of the investigation rules requires investigators to provide sufficient time when requesting a suspect’s appearance so as not to unnecessarily interfere with the suspect’s livelihood. The rules also provide for coordination of the interview date and place and, absent special circumstances, adjustment of the date where the suspect requests a postponement. Accordingly, if you cannot attend because of work, travel, or another legitimate reason, it is generally preferable to explain the situation to the investigating officer in advance and arrange another date. This should be distinguished from simply ignoring the request. Under Article 200-2 of the Criminal Procedure Act, where there are reasonable grounds to suspect that a person committed an offense and the suspect fails to comply with a request to appear without justifiable cause, or there is reason to believe the suspect will not comply, an arrest warrant may become an issue if the statutory requirements are otherwise met. This does not mean that missing a single requested appearance automatically results in arrest. The relevant circumstances and statutory requirements must be considered. What Should You Prepare Before a Police Interview as a Suspect? If you have confirmed that you are being investigated as a suspect, you should review the relevant facts and objective evidence before the interview. A useful starting point is to organize the events chronologically and distinguish between: the conduct or facts being questioned by the police; what actually happened and in what sequence; your role and actions; objective evidence such as contracts, bank records, transfers, emails, or messages; points on which the other party’s account differs from yours; and matters that may require further explanation. For example, if the case concerns money or a contractual relationship, relevant agreements, bank records, and payment records should be reviewed together. If messages or online communications are at issue, individual statements should generally be considered together with the surrounding conversation and context rather than in isolation. You should also avoid guessing when your memory is unclear or altering or deleting existing materials in an attempt to prepare for questioning. Under Article 243-2 of the Criminal Procedure Act, a suspect may request the participation of defense counsel during interrogation, and counsel must generally be permitted to participate unless there is good cause to restrict participation. The official English translation refers to Article 243-2 as “Defense Counsel’s Participation.” Where the allegations are disputed, the parties provide materially different accounts, or the case involves extensive documents or transaction records, reviewing the facts and key legal issues before the first interview can be particularly important. Frequently Asked Questions (FAQ) Q1. How can I verify that the person calling me is actually a police officer? You can contact the relevant police station through its official contact information and confirm the officer’s name and department. Particular caution is warranted if someone claiming to be an investigator asks you to install an application, transfer money, or take other unusual financial actions. Q2. What if the police will not explain the case in detail over the phone? You should not expect the complete investigation record or all evidence collected by investigators to be disclosed during an initial phone call. However, you may ask for basic information necessary to understand the request, including whether you are being contacted as a suspect and what case or alleged conduct the interview concerns. Q3. Do I need to explain my position on the case during the initial phone call? No. A call made to arrange your appearance does not ordinarily require you to provide a complete substantive statement about the case. If you are a suspect, it may be preferable to first understand the allegations and review the relevant records rather than giving an extended account based solely on memory before the formal interview. Q4. Can a lawyer accompany me to a police interview? Yes. A criminal suspect may request the participation of defense counsel during police questioning. Article 243-2 of the Criminal Procedure Act provides that, upon a qualifying request, defense counsel should be permitted to participate in the interrogation unless there is good cause otherwise. Preparing Before a Police Interview Can Be Critical A police request to appear may be made in writing or, in certain circumstances, by telephone or text message. If you receive such a request, first determine whether you are being investigated as a suspect, what case the request concerns, who the investigating officer is, and when and where the interview is scheduled. If you are a suspect, it is important to review the sequence of events and relevant evidence before the first interview and identify any factual or legal issues that may require careful explanation. Decent Law Firm assists clients in criminal investigations by reviewing the relevant facts and evidence, identifying key issues before police questioning, and providing legal representation during suspect interviews.
-
Traffic Accident Settlement Agreements: Why the Settlement Amount and Non-Punishment Statement Matter
1. Do You Always Need a Criminal Settlement with the Victim After a Traffic Accident? Not every traffic accident requires a separate criminal settlement with the victim. Article 3(2) of the Act on Special Cases Concerning the Settlement of Traffic Accidents provides that, in principle, a driver cannot be prosecuted against the victim's express wishes for causing injury through occupational negligence or gross negligence in a traffic accident. Article 4 of the same Act also provides that, in principle, prosecution is barred where the vehicle is covered by qualifying insurance or a mutual aid program that meets certain requirements. As a result, for an ordinary traffic accident, depending on the type of accident and whether comprehensive insurance applies, the criminal process may be resolved through insurance handling without a separate criminal settlement. However, there is an important exception. If the accident involved a serious violation specified in the proviso to Article 3(2) — such as running a red light or crossing the centerline — or falls under another statutory exception such as fleeing the scene without taking necessary measures, prosecution may proceed even if the victim does not wish to see the driver punished. So before asking "do I need to settle with the victim?", a suspect should first check what type of case the investigation is treating this as. 2. Do You Still Need a Separate Settlement Even If Insurance Already Paid Compensation? Because compensation through an insurer and settlement in a criminal case serve different purposes, having gone through insurance processing does not automatically mean a criminal settlement is unnecessary. Auto insurance is primarily meant to compensate civil damages arising from the accident — medical expenses, lost income, and pain and suffering. A criminal settlement, by contrast, is the process in which, while criminal proceedings are ongoing, the suspect pays a separate sum to help the victim recover from the harm and confirms whether the victim wishes to forgo punishment. How Insurance Claims and a Criminal Settlement Differ Category Auto Insurance Claim Criminal Settlement Main Purpose Civil compensation for damages Recovery from harm in the criminal case Who Pays Insurer / mutual aid association The suspect or defendant Main Content Medical costs, lost income, pain and suffering, etc. Settlement amount, non-punishment statement, etc. Relationship to Criminal Proceedings For certain accidents, having insurance itself relates to the special prosecution bar May affect whether charges are filed or the sentence, depending on the type of accident What to Check Insurance coverage and scope of compensation Scope of settlement, nature of the settlement amount, non-punishment statement In particular, Article 4 of the Act on Special Cases Concerning the Settlement of Traffic Accidents carves out an exception to the prosecution bar for insured vehicles where the accident falls under the proviso to Article 3(2), or where the victim suffers a life-threatening injury or an incurable or intractable disease. So the mere fact that the insurer is already paying medical costs does not mean the response to the criminal case is complete. The cause and extent of the accident, together with whether insurance applies, should be reviewed together to determine whether a separate criminal settlement is needed. 3. What Should You Check in a Traffic Accident Settlement Agreement? For a traffic accident settlement agreement, what matters is not the template itself but making clear what accident the payment relates to, how much is being paid, and exactly what scope the parties have agreed on. Some people simply search online for a settlement agreement template and use it as is, but because the reasons a criminal settlement is needed and the insurance situation differ from case to case, using identical wording across cases may not be appropriate. First, the agreement should clearly identify which accident it concerns. It should record the date, time, and location of the accident and the parties involved, and if the case has already been reported to the police, information that can identify the case should be organized as well. Next, the settlement amount and the method of payment should be clearly specified. If the amount has already been paid, records such as bank transfer history that confirm payment should be kept; if payment is scheduled for later, a specific payment deadline should be set. Another important element is the character of the settlement amount. The Supreme Court has taken the position that, absent special circumstances, where a victim in a criminal case receives a settlement amount from the offender and agrees not to seek punishment, that amount is treated as part of the compensation for the victim's property damage. So if compensation through the insurer is proceeding separately, it is worth reviewing what purpose the criminal settlement amount serves and how the agreement addresses its relationship to civil compensation. Finally, what matters most for a suspect is whether the victim's non-punishment intent is actually confirmed. Simply stating that the parties "reached an amicable settlement" or that the victim "received the settlement amount" does not always make clear that the victim does not wish to see the suspect punished. 4. Why Do the Settlement Amount and the Non-Punishment Statement Matter? In a criminal settlement, the fact that a settlement amount was paid and the victim's intent not to seek punishment are separate issues, so it is important to address both together. The Settlement Amount Can Show Real Recovery from the Harm There is no fixed statutory amount for a criminal settlement based on the type of accident. The amount is negotiated between the parties based on individual circumstances, including the severity of the victim's injury, the length of treatment, how the accident occurred, and how much of the harm has already been recovered through insurance. The Supreme Court Sentencing Commission's current sentencing guidelines for traffic offenses also treat "non-punishment intent or substantial recovery from the harm" as a major mitigating factor. These guidelines were revised on March 30, 2026 and have been in effect since July 1, 2026. So if there is a possibility of criminal punishment for a traffic accident, it is worth preparing not only proof that a settlement amount was paid but also evidence of how much of the harm has actually been recovered. A Settlement Agreement and a Non-Punishment Statement Are Not the Same Document A settlement agreement is the document in which the suspect and the victim confirm the settlement amount and the terms of settlement. A non-punishment statement, on the other hand, is a separate document in which the victim clearly expresses that they do not wish to see the suspect punished — its purpose is different. Article 3(2) of the Act on Special Cases Concerning the Settlement of Traffic Accidents is based on the victim's "express intent." So the mere fact that the suspect transferred a settlement amount to the victim does not automatically establish that the victim does not wish to see the suspect punished. If the settlement agreement itself clearly states that the victim does not wish to see the suspect punished, it cannot be said that a separate non-punishment statement is always required for that intent to be validly expressed. Still, because it is important in criminal proceedings to clearly confirm the victim's intent, in practice it matters to record the terms of the settlement and the non-punishment intent through a reliable separate document, such as a non-punishment statement. Timing Matters for the Non-Punishment Statement In an offense where prosecution is barred if the victim objects, there is also a time limit on withdrawing the victim's wish for punishment. Under Article 232(1) and (3) of the Criminal Procedure Act, in a case where prosecution cannot proceed against the victim's express wishes, withdrawing the wish for punishment is possible only before the first-instance judgment is rendered. So in a case that has already gone from a police investigation to trial, rather than simply thinking "we can settle at some point," the current stage of the proceedings and the timing of any settlement should be considered together. 5. How Does the Effect of a Settlement Differ for the 12 Major Traffic Offenses or Cases Involving Serious Injury? Whether a case involves one of the 12 major traffic offenses or an ordinary traffic accident with serious injury can change the legal significance of a victim's settlement and non-punishment intent. First, if the accident falls under the proviso to Article 3(2) of the Act on Special Cases Concerning the Settlement of Traffic Accidents — such as running a red light, crossing the centerline, or violating a pedestrian's right of way at a crosswalk — the victim's wish not to see the driver punished does not have the effect of barring prosecution. In other words, settling with the victim in a case involving one of the 12 major traffic offenses does not automatically end the investigation or trial. That said, this does not mean a criminal settlement is meaningless. Because the current sentencing guidelines for traffic offenses treat non-punishment intent or substantial recovery from the harm as a positive sentencing factor, recovery from the harm and whether a settlement was reached can still be considered in determining the sentence. On the other hand, for an accident involving serious injury under Article 4(1)(2) of the Act, being covered by comprehensive insurance alone does not restrict prosecution. However, if the accident does not fall under the proviso to Article 3(2), the victim's express non-punishment intent regarding occupational-negligence injury and similar charges may still be a separate issue, so it should not be assumed that a serious-injury case will always continue regardless of settlement. Also, cases involving a fatality, fleeing the scene, drunk driving, or other charges under separate statutes may be governed by different rules. So a suspect should check their case in this order: type of accident → applicable charges → whether insurance applies → extent of harm → the effect of settlement and non-punishment intent. 6. Frequently Asked Questions (FAQ) Q1. Do I Still Need a Criminal Settlement If Comprehensive Insurance Is Already Covering All the Medical Costs? It depends on the type of accident. For an ordinary traffic accident, the special protection under comprehensive insurance may apply, but if the case falls under an exception such as one of the 12 major traffic offenses or a statutorily defined serious injury, having insurance alone may not resolve the criminal proceedings. So you should first check what charge the police are investigating, not just whether insurance is being processed. Q2. Do I Have to Pay Whatever Settlement Amount the Victim Demands? You are not legally required to pay exactly the amount the victim proposes. There is no fixed statutory amount for a criminal settlement in a traffic accident; the amount is negotiated between the parties based on the extent of the harm, the length of treatment, how the accident occurred, and how much has already been recovered through insurance. That said, in a case with a real possibility of criminal punishment, it is worth considering not just how large or small the amount is, but what recovering the harm through settlement actually means for the case. Q3. What Should I Do If the Victim Refuses to Settle? A victim cannot be forced to settle. If the victim does not respond to settlement, it is worth objectively organizing how much of the harm has been recovered through insurance and what efforts the suspect made toward a settlement. Because the outcome of a criminal case is not determined by settlement alone, other sentencing factors — how the accident occurred, the degree of negligence, the extent of harm, and any criminal record — should be prepared as well. 7. Summary and Key Takeaways Not every suspect in a traffic accident case needs a separate criminal settlement with the victim. But if a criminal settlement is needed, it matters more to check that the character and scope of the settlement amount and the victim's non-punishment intent are clearly confirmed than simply to use a generic settlement agreement template. In particular, in cases involving the 12 major traffic offenses, proceedings may continue even with a non-punishment statement, while in other types of traffic accidents the victim's express non-punishment intent can carry significant weight in whether charges are filed — so it is important to first identify which category the accident falls into. Decent Law Firm reviews the dashcam footage, the circumstances of the accident, the victim's medical records, and the status of insurance processing to assess the applicable charges and the need for a criminal settlement from a professional perspective. You can also work with attorneys experienced in numerous traffic accident settlements to review the settlement process, the settlement agreement and non-punishment statement, and the response needed at the police investigation and trial stages. If you are facing a police investigation, or are already discussing settlement with the victim, it is best to first check what legal significance a settlement actually has in your case, rather than deciding on the settlement amount first.
-
Crypto Transfers to Self-Hosted Wallets: What Changes Under Korea’s Travel Rule in 2027?
Transfers from a Korean crypto exchange to a self-hosted wallet (personal wallet) such as MetaMask are not currently treated in the same way as Travel Rule transfers between virtual asset service providers (VASPs). However, following the August 2026 amendment to the Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information, Korea will strengthen its AML requirements for virtual asset transfers. From February 19, 2027, the KRW 1 million threshold for the Travel Rule will be removed, and transactions involving overseas VASPs and self-hosted wallets will also become subject to separate risk-based AML requirements. For self-hosted wallet transactions, factors such as who actually owns or controls the wallet, whether the sender and recipient are the same person, the purpose of the transaction, and the flow of funds will become increasingly important. Does the Travel Rule Apply to Transfers to Self-Hosted Wallets? A transfer to a self-hosted wallet is not currently treated in the same way as a Travel Rule transfer between VASPs. Under Korea’s current Travel Rule framework, when a VASP transfers virtual assets worth KRW 1 million or more to another VASP, specified information regarding the sender and recipient must be provided. A self-hosted wallet such as MetaMask, however, is controlled directly by the user and is not itself a Korean VASP. Accordingly, withdrawals to self-hosted wallets should be reviewed not only from a Travel Rule perspective but also in light of the exchange’s AML obligations and wallet verification policies. Depending on the exchange, users may already be required to register a wallet address or verify ownership before making a withdrawal. Official Legislation Enforcement Decree of the Act on Reporting and Using Specified Financial Transaction Information What Will Change for Self-Hosted Wallet Transactions in 2027? From February 19, 2027, virtual asset transfers involving self-hosted wallets will become subject to enhanced risk-based AML controls. The amended Enforcement Decree expands the obligations imposed on VASPs in connection with virtual asset transfers. The Financial Services Commission (FSC) has outlined the following regulatory approach. 🔹 Self-Hosted Wallet and Overseas VASP Transactions from 2027 Transaction Type Expected Regulatory Approach Low-risk overseas VASP Virtual asset transfers generally permitted Other overseas VASPs Generally permitted where the sender and recipient are the same person Self-hosted wallet Generally permitted where the sender and recipient are the same person High-risk transaction Transfer may be restricted or prohibited Transactions of KRW 10 million or more involving overseas VASPs or self-hosted wallets A separate suspicious transaction monitoring framework must be established and operated Accordingly, a withdrawal to a wallet controlled by the customer may be treated differently from a direct withdrawal to a wallet controlled by a third party. However, the detailed risk-assessment standards and implementation methods will need to be reviewed together with the relevant KoFIU regulations and the policies of individual exchanges. Official Source Financial Services Commission – August 11, 2026 What About Deposits from a Self-Hosted Wallet to a Korean Exchange? Deposits from a self-hosted wallet to a Korean exchange may also be subject to review. The amended framework covers transactions in which a VASP transfers virtual assets to, or receives virtual assets from, a self-hosted wallet. Accordingly, when virtual assets are deposited from a self-hosted wallet into a Korean exchange, factors such as the actual wallet owner, the source of funds, and the purpose of the transaction may become important. Where assets are repeatedly deposited from multiple wallets, it is advisable to retain transaction records showing the source and movement of the assets. Can the Travel Rule Be Avoided by Splitting Transfers Below KRW 1 Million? No. Splitting transfers into amounts below KRW 1 million does not place the transactions outside AML scrutiny. The current Travel Rule threshold for VASP-to-VASP transfers is KRW 1 million. From February 19, 2027, this threshold will be removed and the Travel Rule will apply regardless of the transfer amount. Even under the current framework, transactions below KRW 1 million are not automatically excluded from AML monitoring. The FSC has cited a case involving approximately KRW 200 million in virtual assets that was withdrawn through 216 separate transactions below KRW 1 million as an example of activity potentially intended to circumvent regulatory controls. Accordingly, factors such as repeated split transfers, wallet ownership, the source and movement of funds, and the purpose of the transaction may also be reviewed. Frequently Asked Questions (FAQ) Q1. Does the Travel Rule apply when I withdraw crypto to MetaMask? Not in the same manner as a transfer between two registered Korean VASPs under the current framework. However, exchange-specific wallet verification and AML requirements may still apply. From February 19, 2027, self-hosted wallet transactions will also become subject to enhanced risk-based AML controls. Q2. Can I withdraw less than KRW 1 million to a self-hosted wallet without restrictions? A transaction below KRW 1 million is not automatically excluded from AML monitoring. Repeated small withdrawals or transactions involving multiple wallets may still be reviewed based on the overall transaction pattern. In addition, the KRW 1 million Travel Rule threshold between VASPs will be removed from February 19, 2027. Q3. Will transfers to another person’s self-hosted wallet be prohibited? Not necessarily. A blanket prohibition on all transfers to third-party wallets has not been established. However, the Financial Services Commission has indicated that transactions involving self-hosted wallets will generally be permitted where the sender and recipient are the same person. The detailed scope of permitted transactions and exceptions will depend on implementing regulations and individual exchange policies. Q4. Will deposits from a self-hosted wallet to a Korean exchange also be subject to enhanced controls? Yes. The new framework applies not only to withdrawals but also to situations where a VASP receives virtual assets from a self-hosted wallet. The exchange may therefore review wallet ownership, transaction history, source of funds, and the purpose of the transfer. Q5. Does a transaction of KRW 10 million or more automatically trigger a Suspicious Transaction Report (STR)? No. A transaction does not automatically become reportable solely because it exceeds KRW 10 million. The announced framework requires VASPs to establish and operate a separate monitoring system for transactions of KRW 10 million or more involving overseas exchanges or self-hosted wallets. Whether an STR is ultimately required depends on the specific circumstances, including the source of funds, transaction purpose, transaction pattern, and counterparty. Prepare for the New Self-Hosted Wallet Rules Before February 2027 From February 19, 2027, Korea’s Travel Rule will apply to all transfers between VASPs regardless of amount, while risk-based AML controls for transactions involving self-hosted wallets and overseas VASPs will also be strengthened. For self-hosted wallet transactions, actual wallet ownership and control, whether the sender and recipient are the same person, the purpose of the transaction, and the flow of funds may become increasingly important. Businesses that use self-hosted wallets or overseas exchanges for recurring payments, transfers, or settlement should review their transaction structures and applicable regulatory requirements before the new rules take effect. Decent Law Firm advises clients on Korean virtual asset regulations, self-hosted wallet and overseas VASP transactions, Travel Rule compliance, and AML obligations under the Act on Reporting and Using Specified Financial Transaction Information.
-
Crypto Market Making in Korea: Legal Risks for Token Projects and Market Makers
Crypto market making is not automatically considered market manipulation under Korean law. However, the legal analysis does not stop at whether an agreement is labeled as a “market making” or “liquidity provision” arrangement. The key issue is how the trading strategy is actually structured and executed—particularly whether it is designed to artificially create trading volume, influence prices, or induce other investors to trade. For foreign token projects, foundations, and market makers engaging with Korean exchanges or Korean users, this means that the Market Making Agreement, trading instructions, API logic, token lending structure, and fee arrangements should be reviewed together. What Is Crypto Market Making? Crypto market making generally refers to the continuous placement of buy and sell orders in order to provide liquidity to a trading market. For newly listed or relatively illiquid virtual assets, limited order-book depth may result in wide bid-ask spreads and significant price movements even from relatively small orders. To address this, a token project may provide tokens or capital to a professional market maker, which then places buy and sell orders on one or more exchanges. A typical market making arrangement may include provisions concerning: Target exchanges and trading pairs Bid-ask spreads Liquidity or volume requirements Token lending and return arrangements Trading capital Service fees and performance-based compensation API or algorithmic trading systems The important point is that entering into a Market Making Agreement does not determine the legal characterization of the actual trading activity. What matters is how those contractual terms are implemented in the market. Is Crypto Market Making Legal in Korea? Crypto market making is not unlawful merely because liquidity is being provided to the market. However, actual trading activity may fall within Korea’s prohibition on unfair trading if it is intended to induce other investors to trade or to artificially influence trading volume or prices. Article 10 of Korea’s Act on the Protection of Virtual Asset Users prohibits, among other conduct: Matched orders Wash trades Transactions designed to create a false appearance of active trading Transactions intended to artificially move or stabilize the price of a virtual asset Other fraudulent or deceptive trading practices Accordingly, describing a trading arrangement as “liquidity provision” is not sufficient. The actual analysis may require reviewing: Who determines the trading strategy Whether specific price or volume targets are imposed Whether the token project participates in or directs trading decisions Whether the market maker’s compensation is linked to price or volume performance How orders, cancellations, and executions actually occur The distinction between legitimate liquidity provision and unlawful market manipulation therefore depends heavily on the purpose and structure of the actual trading activity. Act on the Protection of Virtual Asset Users – Article 10 What Market Making Structures May Create Higher Regulatory Risk? Market manipulation risk may increase where a market making arrangement goes beyond providing ordinary liquidity and instead seeks to artificially create a particular level of trading activity or price. 🔹Key Market Making Terms to Review Structure Key Legal Issue Minimum trading volume Whether volume is being artificially generated regardless of genuine market demand Target price Whether trading is intended to push the token toward a specified price Price floor or price band Whether the strategy constitutes ordinary liquidity provision or artificial price stabilization Repeated high-priced purchases Whether orders are intended to induce additional buying by other investors Multiple trading accounts Whether economically identical parties are trading against each other API trading How orders, cancellations, and re-orders are triggered Token lending How the market maker may use or dispose of the tokens and how they must be returned Performance fees Whether compensation is directly tied to price appreciation or increased trading volume A contractual requirement to maintain liquidity or a certain spread does not, by itself, establish unlawful conduct. The analysis may change, however, where the actual strategy involves repeated trades unrelated to genuine market demand, artificial volume generation, or continuous buying designed to defend a specific token price. The contractual KPI and the actual trading strategy should therefore be reviewed together. Can API or Algorithmic Market Making Create Market Manipulation Risk? The use of APIs or automated trading systems does not itself constitute market manipulation. Automated order placement is commonly used in market making because market makers must respond quickly to changing order-book conditions. The legal issue is what type of trading strategy has been automated. Additional review may be required where an automated strategy involves, for example: Repeated high-priced purchases Large orders followed by rapid cancellations Multiple accounts placing coordinated orders Repeated trades designed primarily to generate volume Orders designed to influence prices across multiple exchanges In July 2026, the Korean Financial Services Commission disclosed enforcement cases involving virtual asset market manipulation using high-frequency API trading, high-priced purchases, and manipulative order strategies. The significance of these cases is not that API trading itself is prohibited, but that the purpose, order pattern, and resulting market impact of the trading activity are subject to scrutiny. FSC – Key Results of Virtual Asset Unfair Trading Investigations What Should Be Reviewed in a Market Making Agreement? A Market Making Agreement should be reviewed not only for commercial terms, but also for how those terms may influence actual trading behavior. Trading Volume Requirements Where daily or weekly trading volume targets are imposed, the key issue is not simply the existence of a target. The review should determine how the market maker is expected to achieve the required volume and whether the strategy may result in transactions unrelated to genuine market demand. Price-Related Conditions Terms such as “maintain the price above a certain level,” “defend against price declines,” or “reach a target price” require particular attention. Ordinary spread management and trading intended to artificially maintain or influence a specific market price should not be treated as the same activity. Token Lending and Return Where a project provides a significant number of tokens to the market maker, the agreement should clearly address: Permitted use of the tokens Disposal authority Return obligations Settlement mechanics Allocation of trading profits and losses Performance Fees and Trading Authority Performance-based compensation should also be examined, particularly where fees are linked directly to token price appreciation or trading volume. In addition, even where the written agreement gives the market maker independent trading authority, actual instructions sent through Telegram, Slack, email, or other channels may become relevant if the project is directing specific price or volume outcomes. Is Reviewing the Market Making Agreement Alone Sufficient? No. The agreement and the actual operating structure should be reviewed together. A contract may simply refer to “liquidity enhancement,” “spread maintenance,” or “market making services.” Actual communications or trading instructions, however, may contain materially different expectations concerning price support or volume generation. For this reason, a legal review may need to cover not only the agreement itself but also: Market Making Agreement and side letters Internal operating guidelines and KPIs Exchange order and execution records API logic and trading parameters Trading-account structure Token and fund transfers Telegram, Slack, email, and other trading instructions Fee and performance compensation arrangements The key issue is not only what the contract says, but how the contractual terms are implemented through actual orders and executions. Do Korean Rules Apply to an Offshore Market Maker? Using an offshore market maker does not automatically exclude the application of Korean law. Article 3 of the Act on the Protection of Virtual Asset Users provides for extraterritorial application where conduct outside Korea produces effects within Korea. Accordingly, Korean regulatory exposure should be considered where, for example: Market making is performed on a Korean exchange A token is listed on both Korean and overseas exchanges Trading on an offshore exchange is used to influence the Korean market A Korean project directs an offshore market maker regarding price or volume Korean regulators have also investigated cases involving virtual assets listed simultaneously on Korean and foreign exchanges where trading activity across markets was allegedly used to influence Korean investors. Depending on the exact scope of services, it may also be necessary to consider whether the market maker’s activities raise separate issues under Korea’s virtual asset service provider regulatory framework. Act on the Protection of Virtual Asset Users What Should Be Reviewed Before Entering into a Market Making Arrangement? Before entering into a Market Making Agreement, the project and market maker should align the contractual terms with the anticipated trading structure. 1. Roles and Trading Authority Determine who establishes the trading strategy and who has authority to execute orders. 2. Price and Volume KPIs Review whether spread, liquidity, volume, or price-related KPIs may require problematic trading behavior in practice. 3. Token and Fund Flows Map how tokens and trading capital move from the project to the market maker and ultimately to exchange accounts. 4. Trading Method Determine whether trading will be manual, API-based, or algorithmic, and whether multiple accounts or exchanges will be used. 5. Compensation Structure Assess whether compensation is simply payment for liquidity services or is directly tied to price appreciation or increased trading volume. The relevant contracts, order logs, API records, internal instructions, and token transfer records should also be retained appropriately. These materials may become important if the trading activity is later reviewed by an exchange, regulator, or investigative authority. What Are the Consequences of Market Manipulation in Korea? Market manipulation involving virtual assets may lead to administrative sanctions, criminal liability, and civil damages. The Act on the Protection of Virtual Asset Users provides for monetary penalties in relation to unfair trading conduct and criminal penalties for violations of Article 10. The severity of sanctions may vary depending on factors including the amount of unlawful profit or avoided loss. The Financial Services Commission announced in July 2026 that, during the first two years following implementation of the Act, Korean authorities had completed approximately 40 unfair-trading investigations and referred or reported more than 30 cases to investigative authorities. Accordingly, market making structures should not be reviewed only after an enforcement issue arises. Potential unfair-trading exposure should be assessed at the contract and trading-structure stage. FSC – Key Results and Future Plans for Virtual Asset Unfair Trading Investigations Frequently Asked Questions (FAQ) Q1. Is using a crypto market maker illegal in Korea? No. The use of a market maker does not itself establish market manipulation. The actual trading strategy, purpose, project involvement, and price or volume conditions must be reviewed. Q2. Can a Market Making Agreement require a minimum trading volume? A minimum volume requirement is not automatically unlawful. However, if the target is achieved through transactions intended to create an artificial appearance of active trading, the arrangement may raise unfair-trading concerns. Q3. Can a project ask a market maker to maintain a minimum token price? Price-support or price-floor arrangements require particular caution. Korean law prohibits certain transactions conducted for the purpose of inducing other investors to trade by artificially moving or stabilizing the market price. Q4. Is API-based market making considered market manipulation? No. The use of an API itself is not prohibited. The relevant issue is whether the automated strategy is designed to artificially generate volume, influence prices, or induce other investors to trade. Q5. Does Korean law apply to foreign market makers? It may. Where offshore trading produces effects in Korea, including through Korean exchange markets or Korean investors, the potential application of Korean virtual asset regulations should be reviewed. Market Making in Korea Requires More Than Contract Review The central legal issue in crypto market making is not whether a contract describes the activity as “liquidity provision.” The key questions are how orders are actually generated, what objectives the project gives to the market maker, and what price and trading volume are ultimately created by the strategy. Where price targets, volume KPIs, API trading, token lending, and performance compensation are combined, the legal analysis should cover both the written agreement and the actual operating structure.
-
Voice Phishing Cash Collection Agent Penalties in Korea: What If You Thought It Was Just a Part-Time Job?
In voice phishing cases involving cash collection agents, criminal liability is not determined solely by the fact that the person received and delivered cash. The key issue is whether the person knew that their actions were being used as part of a criminal scheme—in other words, whether criminal intent and participation in the scheme can be established. Even if a person started the job after being told through a recruitment website that it involved debt collection or document delivery, criminal liability may arise depending on the recruitment process, communication methods, actual job duties, and the manner in which cash was collected and transferred. 1．What Is a Voice Phishing Cash Collection Agent? A cash collection agent generally refers to a person who receives cash from a voice phishing victim and delivers it to the criminal organization. Under the current Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, Article 2, telecommunications-based financial fraud includes not only schemes in which victims are induced to transfer money to an account, but also schemes in which funds are collected directly from victims. Accordingly, even if a person did not personally make fraudulent calls or send deceptive messages to the victim, criminal liability may still arise if that person participated in collecting and transferring the victim’s cash. Relevant Law Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, Article 2 2．Can You Be Punished Even If You Only Collected and Delivered Cash? Yes. If criminal intent and participation in the voice phishing scheme are established, a cash collection agent may be held criminally liable even if they did not personally deceive the victim. The Supreme Court of Korea has held that a cash collection agent does not need to know the entire method of the fraud or the full structure of the criminal organization. Criminal intent and participation may still be established if the person at least recognized that they were collecting victims’ cash as part of a coordinated criminal scheme. Conversely, if the person genuinely did not know that their conduct was being used for criminal activity, criminal intent may not be established. Therefore, investigators and courts do not rely solely on a statement such as “I did not know.” They examine the objective circumstances surrounding the work Relevant Case Supreme Court of Korea, December 12, 2024, Case No. 2024Do10141 3．How Do Courts Assess a Claim That “I Thought It Was Just a Part-Time Job”? Courts consider the recruitment process, actual job duties, and other surrounding circumstances to determine whether the person was aware that the work was connected to criminal activity. 🔹Key Factors in Determining Criminal Intent Factor What May Be Examined Recruitment process Whether there was a normal interview or identity verification process Contractual relationship Whether an employment or service agreement was properly executed Communication method Whether instructions were given only through anonymous services such as Telegram Actual duties Whether the person was instructed to collect large amounts of cash from strangers Interaction with victims Whether the person was instructed to impersonate an employee of a financial institution or another company Transfer method Whether the collected cash was divided and transferred through multiple transactions Frequency and amount Whether large amounts of cash were collected repeatedly Compensation Whether the payment was unusually high compared with the nature of the work Personal circumstances Whether age, work experience, and social experience made it possible to recognize that the work was unusual No single factor automatically establishes criminal intent. The Supreme Court considers multiple circumstances together, including the content and method of communications with the organization, how the person was recruited, how the cash was collected, what was said or done to the victim, the number and amount of collections, the transfer method, compensation, and the individual’s personal and professional background. 4．What Are the Penalties for a Voice Phishing Cash Collection Agent? A person found to have participated in voice phishing as a cash collection agent may face criminal penalties. Under Article 15-2 of the Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, a person who commits telecommunications-based financial fraud may be punished by imprisonment for at least one year or a fine equivalent to three to five times the criminal proceeds, or both imprisonment and a fine. However, the same charge or sentence does not apply automatically to every cash collection agent. The applicable offense and actual sentence may differ depending on when the conduct occurred, the person’s degree of participation, the number and amount of collections, their actual role, whether the victim was compensated or a settlement was reached, and the person’s criminal record. The Sentencing Guidelines for Fraud Offenses issued by the Sentencing Commission of the Supreme Court of Korea also take into account factors such as minor or passive participation, substantial recovery of damages, and prior criminal history. Relevant Law Act on Special Cases Concerning the Prevention of Damage from Telecommunications-Based Financial Fraud and Refund for Damage, Article 15-2 5．What Should You Prepare If You Are Under Police Investigation as a Cash Collection Agent? Before the first police interview, it is important to organize the circumstances of your involvement and preserve objective evidence showing what you understood the job to be. If the key issue is whether you knew the work was connected to voice phishing, the following materials should be reviewed: Recruitment advertisements, text messages, and other recruitment and hiring records KakaoTalk, Telegram, text messages, and other communications containing work instructions Records showing when and where cash was received and how it was transferred, including cash collection and transfer records Compensation records and company-search history showing why you believed the work was legitimate Do not delete relevant chat records or transaction records after an investigation has begun. Decent Law Firm reviews the circumstances of the client’s involvement and the likelihood that criminal intent may be found, and assists with the response strategy from the police investigation stage. 6. Frequently Asked Questions (FAQ) Q1. If I am a first-time offender, can a cash collection agent case end with only a fine? A first offense does not guarantee that the case will result only in a fine. The actual sentence depends on factors such as the degree of participation, amount of loss, number of offenses, recovery of damages, and prior criminal history. Q2. Can I be punished if I collected or delivered cash only once? Yes. Even a single act may result in criminal liability if criminal intent and participation in the scheme are established. However, the number and amount of collections are only some of the factors considered. The circumstances under which the person accepted the job and what they understood at the time must also be reviewed. Q3. Can I be treated as an accomplice even if I never met anyone from the voice phishing organization? Yes. The fact that you never personally met an organizer does not, by itself, exclude criminal participation. The Supreme Court has held that a coordinated criminal relationship may be established even without an express meeting or detailed agreement, including where the participants’ intentions were connected sequentially or implicitly. Q4. If I settle with the victim, will I avoid punishment? A settlement does not automatically terminate the criminal case. However, substantial recovery of damages or the victim’s request for leniency may be considered favorably during sentencing. Q5. Can I simply tell the police that I did not know it was voice phishing? Simply stating that you did not know may not be sufficient. The investigation may examine objective circumstances such as the recruitment process, communications, cash collection method, transfer method, compensation, and frequency of the transactions. 7. Summary and Key Considerations The central issue in a voice phishing cash collection case is whether the person knew that their conduct was being used as part of a criminal scheme. Even without detailed knowledge of the entire organization or fraud method, criminal liability may arise if implied awareness and participation are established. If you are facing a police investigation, the circumstances of the case and available evidence should be reviewed from the outset to determine whether criminal intent may be established and how the investigation should be handled. ※ The applicable law and potential criminal liability may vary depending on the date of the conduct and the specific facts of each case.
-
Crypto Hacking Response Guide: What to Do First After You Discover a Breach
1. What Should You Check First When You Discover You've Been Hacked? The first thing to determine is exactly how your crypto assets left your control. Even incidents that look like the same "crypto hacking" can involve very different response strategies and liability structures — a compromised exchange account, a leaked wallet seed phrase, and a fraudulent signature approved on a phishing site are not the same problem. So as soon as you confirm the loss, the first step is to identify which type of incident you are dealing with. Type of Incident What to Check First Immediate Response Exchange account compromised Login history, withdrawal history, whether 2FA settings were changed Request an account/withdrawal freeze Personal wallet compromised Whether the seed phrase or private key was exposed Consider moving remaining assets to a new, secure wallet Phishing site interaction The URL visited, and any signatures or token approvals granted Block further approvals/access and preserve evidence Malware/remote access Installed programs, access and execution logs Stop using the infected device and preserve evidence Exchange-side breach The exchange's incident notice, affected assets, and scope of damage Check the exchange's notice and claims procedure Identifying the type of incident first makes it much easier to determine what evidence to gather and who may ultimately be liable. In particular, if the loss occurred while using an exchange, it is worth checking not only how well you managed your own account, but also whether the exchange was properly safeguarding user assets. Under Article 7 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to keep their own assets separate from user assets and to actually hold the same type and quantity of virtual assets entrusted to them by users. In addition, the current Regulation on Supervision of Virtual Asset Business requires at least 80% of the economic value of user assets to be kept in an environment separated from the internet (cold storage). So if the breach occurred at an exchange, rather than concluding simply that "the account was hacked," it is important to work out exactly how authentication was carried out and which account or wallet the withdrawal came from, since this will affect how liability is ultimately determined. 2. What Should You Do Immediately to Stop Further Losses? Once you confirm the breach, the first priority is to stop any remaining crypto assets from being drained further. If the breach occurred on an exchange account, the first step is to contact the exchange's customer support or incident report channel to check whether login or withdrawals can be restricted. At this stage, don't stop at simply changing your exchange password — check whether other authentication methods, such as your email, phone number, or OTP, may also have been compromised. If the issue originated in a personal wallet, the seed phrase or private key itself may already be exposed. In that case, rather than continuing to use the same wallet, you should consider creating a new wallet in a verified, secure environment and moving any remaining assets there. That said, be careful about immediately resetting a compromised phone or computer. The device may still hold records — phishing site visit history, malware, login logs — that show exactly how the account or wallet was compromised. What to Check Immediately After a Crypto Hacking Incident Request a freeze on further withdrawals from the exchange account Check whether your password, OTP, or other authentication methods were compromised Review protective measures for any remaining crypto assets Avoid resetting the affected device without careful thought Preserve withdrawal alert emails, texts, and app notifications Save your exchange customer support inquiries and their responses What matters at this stage is not rushing into every possible action, but balancing preventing further damage with preserving evidence. At Decent Law Firm, in the initial consultation we first identify the structure of the incident — whether it involves a compromised exchange account, a compromised personal wallet, or phishing/remote access — and based on that, help determine what evidence should be preserved first and what should be requested from the exchange. 3. What Evidence Should You Secure After a Crypto Hacking Incident? Once you've stopped further losses, the next step is to gather as much evidence as possible showing how the stolen assets moved. In crypto cases, what matters most is not just a screenshot of the loss, but the transaction records showing exactly when the assets moved, from which address to which address. Where possible, try to preserve the following information in as close to its original form as possible. Evidence You Should Secure Date and time of the incident Type and quantity of the stolen crypto assets Value of the assets in Korean won at the time of the loss The withdrawal (sending) wallet address The receiving wallet address The TXID or transaction hash The exchange or wallet service used Login and access notifications OTP, phone, and email authentication records Password change notifications Records of exchange customer support inquiries The phishing site URL Related text messages, emails, and messenger conversations Information on any suspicious programs or apps Of these, the TXID and wallet addresses are the core evidence for tracing how the assets moved afterward. On public blockchains, a block explorer can be used to trace how assets moved from the initially compromised address to other addresses. Records kept internally by the exchange also matter. Under Article 9 of the Act on the Protection of Virtual Asset Users, virtual asset business operators are required to retain transaction records — sufficient to trace, search, and verify transactions — for 15 years from the end of the transactional relationship. However, the fact that an operator retains transaction records is a separate question from whether a victim can immediately obtain all of the internal data they want. Login IP addresses, authentication data, withdrawal approval processes, and other internal system records may not be voluntarily disclosed by the exchange, and may need to be obtained through the proper legal process during an investigation. So before filing a report, it helps to separate what you can gather yourself now from what will need to be obtained later through the investigating authorities. At Decent Law Firm, based on the transaction history, TXIDs, wallet addresses, and exchange responses a victim has secured, we organize a chronological timeline of how the assets moved from the moment of the loss, and structure the facts and evidence so they can be used effectively in a police report or criminal complaint. 4. Can Crypto Assets Already Moved to Another Wallet Still Be Traced or Frozen? Even after crypto assets have moved to another wallet, it is sometimes still possible to trace the transaction path on the blockchain. However, being traceable and being actually recoverable are two different questions. On public blockchains, the transfer from the originally compromised wallet to another wallet remains on the record. So it is possible to check where the stolen assets moved afterward, and whether they show signs of having flowed into a domestic or overseas centralized exchange. In particular, if the assets are confirmed to have moved into a deposit address at an identity-verified centralized exchange, the account information and transaction records held by that exchange can become important evidence for an investigation. Factors to Check When Assessing Recovery Potential Factor What It Means Current custody wallet Whether the stolen assets still remain at that address Inflow to a centralized exchange Whether identity verification may be possible through an exchange account Further movement of assets Whether the assets were quickly split across multiple addresses Change of chain Whether the assets were moved to another network via a bridge Asset conversion Whether the assets were converted into a different crypto asset Use of an overseas operator Whether cooperation from a foreign exchange or international cooperation is needed That said, confirming that assets moved on the blockchain does not mean those assets can be immediately frozen. Reporting and freezing procedures differ from exchange to exchange, and actually freezing assets or obtaining account information may require legal process, such as a request from investigating authorities or a warrant. In addition, if assets have been split across multiple wallets, moved to a different chain, or converted into a different crypto asset, tracing and recovery become considerably more complex. So you should not assume either that "there is a blockchain record, so recovery is guaranteed" or, conversely, that "the assets already moved to another wallet, so recovery is impossible." At Decent Law Firm, based on the secured TXIDs and wallet addresses, we map out how the assets moved, and where there are signs that assets flowed into a specific exchange, we organize the material so that fact is clearly communicated to the investigating authorities. Where an overseas exchange is involved, we also consider that exchange's own damage-reporting and evidence-preservation procedures, along with whether international cooperation through Korean investigating authorities is needed. 5. What Is the Right Order for Filing a Police Report and Seeking Recovery? Once you have organized the facts of the loss and the basic transaction data, the next step is to consider filing a report with the investigating authorities. You can report hacking and other cybercrime damage through the Korean National Police Agency's Cybercrime Reporting System (ECRM), which asks you to specify the date and details of the loss and describe how the crime occurred. In crypto cases, rather than simply stating "my coins were hacked," it is important to organize and submit materials that let investigators immediately understand the structure of the incident. What to Organize Before Filing a Report 1) How the Incident Occurred Note the last time you used the account normally, and when you first noticed the unusual withdrawal. 2) The Assets Affected Summarize the type and quantity of crypto assets involved, and the total loss. 3) The Fraudulent Transaction Confirm the TXID and the sending/receiving wallet addresses. 4) Signs of Account Compromise Note any confirmed signs such as foreign IP access, password changes, OTP changes, or a compromised email account. 5) Movement of the Assets After the Theft If you can confirm the assets moved to another wallet or exchange, include that information as well. Organizing this information in advance helps investigators determine which exchange or business operator to seek records from, and what specifically to request. At Decent Law Firm, after organizing the facts of the incident and the asset movement history, we help specify the exchange accounts, access logs, authentication records, and wallet addresses that investigators will need to confirm during a criminal complaint or report. Even after an investigation begins, if new wallet addresses or signs of exchange inflow are identified, they should be organized as additional evidence and submitted. 6. Frequently Asked Questions (FAQ) Q1. My coins were moved to another wallet through hacking — can the transaction be reversed? Once a transfer is recorded on the blockchain, it is generally very difficult to reverse it the way you might cancel a bank transfer. So rather than trying to cancel the transaction itself, it is more important to identify the current location of the stolen assets and their transaction path, and check whether they have since flowed into an exchange. Q2. If the stolen coins moved to an overseas exchange, does that mean recovery is impossible? The mere fact that the assets moved to an overseas exchange does not mean recovery is impossible. That said, the required procedure and its difficulty can vary depending on the exchange's home country and policies, whether it holds user identity information, the current status of the assets, and the likelihood of cooperation with Korean investigating authorities. Q3. Should I immediately reset a phone or computer that was hacked? Taking steps to prevent further damage is necessary, but resetting the device unconditionally before all the case evidence has been secured requires caution. The affected device may still contain access logs, phishing URLs, malware, and other data showing how the breach occurred, so it is worth preserving the necessary evidence first before proceeding with safety measures. 7. Summary and Key Points If you experience a crypto hacking incident, the first priority is to stop any further withdrawals and secure evidence — TXIDs, wallet addresses, login and authentication records — that can help establish what happened. If the crypto assets have already moved to an external wallet, you should trace the path from the original fraudulent transaction onward, and where there are signs the assets flowed into a specific exchange, consider pursuing evidence preservation and a potential freeze through the investigating authorities. If the cause of the loss appears related to the exchange's own authentication or custody systems, it is also worth examining the exchange's legal obligations and the possibility of a damages claim. At Decent Law Firm, we review the transaction history, TXIDs, wallet addresses, and exchange usage records to reconstruct how the incident occurred and how the assets moved, and help build out the facts and evidence needed for a police report or criminal complaint. Where the stolen assets show signs of moving through domestic or overseas exchanges, we also look at the possibility of requesting evidence preservation or a freeze from the exchange, along with further steps through the investigating authorities, and where the incident relates to the exchange's security or custody obligations, we consider the full path toward recovery, including a damages claim. Because crypto assets can move through multiple wallets and exchanges in a very short time, once you confirm a loss, the priority is to organize whatever evidence you can secure right now, and to get help from a professional as soon as possible so you have the best chance of recovering your lost funds.
