After Binance's hack, South Korea wants more crypto kept offline. Pakistan's rule sets no number

Updated 3 November 2026: Binance has published a zero-knowledge proof of reserves for a snapshot taken on 31 October. It says users holding ten tokens, including bitcoin, USDT and BNB, can check that their balances are backed at least one to one. Binance still puts its coverage of the stolen amount at "approximately 95%". It says the rest is in tokens outside those ten, and that "these losses will not be passed on to users". Cointelegraph reports that Binance confirmed moving 7,499 bitcoin out of its SAFU emergency fund, about half of the fund. A second phase of withdrawals opened at 9 am Pakistan time on 3 November for selected assets; Binance says not all assets are available yet. These are Binance's own statements. No outside firm has audited them.

Key takeaways

• South Korea's Financial Services Commission called an emergency meeting on 2 November and asked exchanges to raise the share of assets they keep in offline "cold" wallets.
• Korean exchanges must already keep at least 80% of users' crypto in cold wallets, local media report.
• Binance says the $6.3 billion stolen last week came from its "hot", internet-connected wallets.
• Pakistan's custody rules require "the majority" of client assets offline "where appropriate", without a number. They bind only licensed firms, and none is licensed.

South Korea's Financial Services Commission (FSC) met its supervisors, the Financial Security Institute, the exchanges' industry body DAXA and the country's main exchanges on Monday morning. The trigger was Binance. On 30 October the world's largest exchange said about $6.3 billion had been taken without authorisation from its hot wallets.

The FSC asked Korean exchanges to do four things: raise the share of assets held in cold wallets, watch deposits and withdrawals around the clock with more staff, report and share any suspicious attempts to get in, and set aside more reserves. Its statement gave no new percentage.

Hot wallets, cold wallets

An exchange holds customers' coins in wallets controlled by private keys. A hot wallet is connected to the internet, so withdrawals can be processed quickly. A cold wallet keeps its keys offline, so an attacker who breaks into the company's network cannot reach it directly. Exchanges keep some money hot so customers can withdraw, and the rest cold.

Binance said in its second incident update that "our hot wallets were compromised". The FSC's statement says the attackers may have got in through an employee's work laptop and then reached the systems that approve and sign transactions. The FBI has attributed the theft to North Korea. Binance says it "has now covered approximately 95% of the impacted amount", as we reported in our story on the hack.

What Korea requires

Under Korea's Virtual Asset User Protection Act, exchanges must keep at least 80% of users' crypto, by value, in cold wallets cut off from the internet, the Korean tech daily etnews reported. The big exchanges are already above that. Figures from Korea's Financial Supervisory Service for September, as reported by Cointelegraph, put Upbit at 99.17%, Bithumb at 94.76%, Coinone at 85%, Digital X at 82.79% and GOPAX at 80.54%.

The FSC now wants that share higher. It has not set a new floor. According to etnews, the FSC plans rule changes to bring bank-level security to exchanges.

What Pakistan's rules say

Pakistan's rules on crypto custody are in the activity-specific regulations, S.R.O. 1420(I)/2026, which PVARA notified on 21 August. Regulation 7(7) of the custody rules says a custodian must run a "risk-based wallet allocation framework" that:

• "limits the proportion of Client Assets held in hot or online environments to levels commensurate with operational needs and risk appetite";
• "ensures that the majority of Client Assets are held in secure offline or equivalent environments where appropriate"; and
• is approved by the firm's board and reviewed regularly.

"The majority" means more than half. That is a lower bar than Korea's 80%, and "where appropriate" leaves the firm room to argue for less. The rules are stronger on who can move money. Regulation 8 bars any "single point of access" that lets a transaction go through without further checks, and says that, where appropriate to "the scale and risk of the custody model", "no single individual or system can unilaterally transfer Client Assets". Client assets must be reconciled at least daily.

Those rules bind only licensed firms. Binance holds a PVARA no-objection certificate, not a licence, and its deadline to apply for one falls around 21 November. PVARA had issued no statement on the hack when we checked its news page on 3 November.

What this means for Pakistani users

• No PVARA custody rule applies to your exchange yet. No exchange is licensed by PVARA, so the custody rules above do not cover anyone serving you today.
• Ask how much is kept offline. Some exchanges publish cold-storage ratios or proof-of-reserves reports. If yours does not, that tells you something.
• The safest coins are the ones you control. Money left on an exchange is only as safe as its hot wallets. If you hold for the long term, learn how a self-custody wallet works before you need one, and never share your seed phrase.

What we're watching

• Whether PVARA sets a number for offline storage, in guidance or in licence conditions, before the first licences.
• Whether Korea's FSC turns Monday's request into a higher legal minimum.
• What Binance's own post-incident report says about how much it kept in hot wallets.

Sources

• Financial Services Commission (Korea), press release on the emergency meeting with virtual asset service providers, 2 November 2026 (Korean).
• etnews, 바이낸스 8조원 해킹 쇼크…금융위, 코인거래소 보안벽 높인다, 2 November 2026 (Korean).
• Cointelegraph, South Korea urges exchanges to boost cold storage after Binance hack, 3 November 2026.
• Binance, Security Incident Update #2, 30 October 2026.
• FBI, North Korea Responsible for $6 Billion+ Binance Attack, 31 October 2026.
• PVARA, S.R.O. 1420(I)/2026, activity-specific regulations, Custody Services Regulation, regulations 7 to 9.