The security defenses of cryptocurrency exchanges are facing unprecedented regulatory pressure. The recent draft regulations proposed by the Korea Financial Services Commission (FSC) have completely changed the penalty logic for security vulnerabilities in exchanges.

The trigger was the November 2025 hack of Upbit, which resulted in assets stolen worth $36 million. Under the old regulatory framework, the maximum fine was only $456,000—relatively limited compared to the stolen amount. But once the FSC's new plan was announced, the game changed entirely.

The new draft proposes a two-tier progressive penalty mechanism: the first tier fines up to 10% of the stolen assets, meaning if the new regulations applied to the Upbit incident, the fine would soar to $36 million, nearly 8 times the old cap. The second tier fines up to 3% of the exchange's annual revenue, with a maximum of $36 million. In other words, regulators are using two calculation methods to ensure that no matter the size of the exchange, the penalties will be "painful."

More strictly, the FSC also requires exchanges' IT security systems to be on par with traditional financial institutions. This not only signifies a substantial increase in technological investment but also means the entire industry's security standards are being forcibly upgraded.

Although these provisions are still under discussion, the direction is clear—using the punitive power of fines to compel exchanges to strengthen security measures. It is foreseeable that the security competition within the crypto industry will escalate to new heights this time.