Widespread Lack of Security Certification on South Korean Exchanges, Top Platforms Allocate Only 10% of Budget to Security

[Crypto World] South Korea’s crypto exchanges have exposed yet another security loophole. The latest report from the Internet Security Agency shows that many platforms haven’t even obtained the most basic personal information protection certifications.

Among the six illegal crypto exchanges registered with the financial intelligence unit this year, five only received the basic ISMS certification—which doesn’t cover personal information protection at all. To make things more awkward, mainstream platform GOPAX hasn’t obtained the ISMS-P certification either. What’s the difference between these two certifications? The former only looks at system security, while the latter covers how you protect user privacy.

The investment data from major platforms is even more telling. Financial reports submitted by Upbit, Bithumb, and GOPAX to the security agency show they allocate around 10% of their total IT budget to information security—sounds like a lot? But security team members only account for 9% to 12.5% of their staff. With this setup, a 100-person tech team might have only about a dozen people monitoring security vulnerabilities.

Coinone and Korbit, ranked third and fourth, don’t even voluntarily disclose their security measures. Disclosure is required by regulators, but in practice, it’s all on the honor system—this approach has become the norm in the Korean market.