Exposure of Security Investments by Korean Exchanges: Major Exchanges Allocate Only 10% of Budget to Security, Many Platforms Lack Certifications

[Chain News] Security issues at Korean exchanges have been exposed again recently.

That report from the Internet Security Agency is pretty painful to read—a bunch of platforms haven’t even obtained the most basic ISMS-P certification. This is the minimum passing line for personal information protection. Among the six illegal crypto exchanges that just registered with the FIU this year, five only hold the basic ISMS certification. What’s the problem? This certification doesn’t even include requirements for user privacy protection. What’s even more outrageous is that even GOPAX, which supports KRW trading, hasn’t secured ISMS-P.

Looking at the investments made by the major exchanges, the data is even more bizarre. According to disclosures to KISA from Upbit, Bithumb, and GOPAX, their spending on information security only accounts for about 10% of their total IT budget. Staffing is even more dismal—the security teams make up just 9%, 10.2%, and 12.5% of the workforce, respectively.

The most outrageous move comes from Coinone and Korbit—Korea’s third and fourth largest exchanges—who simply chose to stay silent about their security measures and couldn’t even be bothered to make a voluntary disclosure.

With this level of investment in security, it’s hard to see how user assets can withstand various attacks. If they don’t address these weaknesses in compliance and security, it’s only a matter of time before something major happens.