GOPAX suspends trading and regular crypto withdrawals after threat email

South Korean cryptocurrency exchange GOPAX suspended trading, crypto deposits and standard crypto withdrawals on November 6 after receiving an email from a sender claiming the exchange had been hacked.

GOPAX said the threat’s credibility had not been established and reported no loss of customer assets as of 10:03 p.m. Korea Standard Time, when Yonhap published its updated account. The company nevertheless began transferring cryptocurrency into offline storage and canceled every unfilled trading order.

The distinction is important: the available evidence establishes a precautionary service shutdown, not a successful intrusion or theft. It also was not a complete freeze on customer exits. Regular withdrawals through GOPAX’s website and app stopped, but customers could submit requests for manual review and processing through the support center.

Services stopped in two stages

GOPAX halted crypto deposits and standard withdrawals at 2:55 p.m. Korea Standard Time on November 6. Trading stopped at approximately 3:53 p.m., according to the exchange’s notices and contemporaneous reports from Yonhap and Herald Business.

Coinone, another South Korean exchange, independently warned its customers that crypto sent to GOPAX might not be credited normally during the interruption. Coinone’s notice confirms the 2:55 p.m. transfer suspension and demonstrates that the operational consequences extended to transfers initiated from another venue.

The reviewed records do not establish whether Korean won deposits or withdrawals were affected. They address cryptocurrency transfers, the regular crypto-withdrawal interface and trading. That limitation matters because describing GOPAX as completely inaccessible would overstate the evidence.

GOPAX said manual withdrawal requests would undergo internal verification and approval before being processed sequentially. That route preserves a way to move cryptocurrency out, but it is not equivalent to an ordinary automated withdrawal service and may take longer. The exchange disclosed no processing target or maximum delay.

Cold storage reduces one risk while limiting immediacy

GOPAX said it would move its cryptocurrency holdings into cold wallets, meaning storage systems kept offline rather than continuously connected to transaction infrastructure. This can reduce exposure to an attacker targeting online signing systems, but the announcement does not prove that every transfer was completed or that the exchange’s broader systems were uncompromised.

Cold storage also changes how withdrawals work operationally. Assets held offline generally require additional authorization and handling before they can be transferred. GOPAX’s decision to pair the move with manual withdrawal reviews therefore trades speed and routine market access for tighter control while the threat is assessed.

The company described its action as consistent with recommendations from South Korean financial authorities following recent security incidents. The notices and reporting do not show that a regulator ordered this specific shutdown, set its duration or independently validated GOPAX’s security.

No restart date appeared in the official notices or in the reports reviewed for this article. GOPAX said it planned to verify security before resuming services, leaving the duration and commercial impact unresolved.

What remains unverified

The threat-email account is attributable to GOPAX representatives quoted by Korean news organizations. The sender was not identified publicly, the email was not released, and no technical indicator, affected wallet, transaction identifier or forensic report was provided.

Accordingly, there is no verified basis to call the incident a hack, quantify assets at risk or attribute the threat to a particular actor. The absence of a reported loss as of the November 6 reporting window is also not a guarantee that later investigation will find no compromise.

The next material evidence will be a GOPAX notice restoring trading and standard withdrawals, a regulator’s statement, or a technical disclosure explaining whether the threat corresponded to unauthorized access. Until then, the defensible conclusion is narrow: GOPAX interrupted normal exchange operations and tightened custody procedures in response to an unverified threat, while keeping a manually reviewed withdrawal channel available.