South Korea’s financial regulator has identified two cryptocurrency businesses among 16 financial companies affected by a recent wave of customer-data breaches, placing crypto firms alongside several of the country’s major banks in a widening cybersecurity review.
The Financial Services Commission, or FSC, named Streami and Pravang in a disclosure dated October 14. Streami operates the Gopax cryptocurrency exchange, while Pravang was the other virtual-asset business included in the announcement. The list also included Shinhan, Kookmin, Busan and Hana banks, as well as companies from other parts of the financial sector.
According to CryptoSlate, the regulator estimates that roughly 100,000 pieces of customer information were exposed across the affected companies. The FSC did not provide a breakdown showing how many records came from each business, so the scale of the exposure at Streami, Pravang or any individual bank remains unclear.
The information involved included names, contact details, resident registration numbers and email addresses. At the time of the FSC meeting on October 14, authorities had not identified leaked account passwords or credit card numbers, according to the regulator’s English-language release. The disclosure therefore established the types of information potentially exposed but did not confirm that every category had been compromised at every company.
Investigation broadens beyond confirmed breaches
The Financial Supervisory Service and the Financial Security Institute are examining how the attacks were carried out and whether the incidents are connected. Their review will also consider whether a single attacker may have been responsible and whether artificial intelligence was used in the attacks.
The number of affected companies could still increase. Authorities have shared attacker internet-protocol addresses with companies, allowing them to compare those indicators with activity recorded on their own systems. Firms that identify matching activity could be added to the list as the investigation continues.
A separate sector-wide check found security weaknesses even at companies that were not included in the confirmed breach disclosure. All 555 companies covered by the review completed a 12-point self-assessment by October 8. Of those, 425 said their arrangements were appropriate, while 130 reported areas that required improvement.
The reported weaknesses were concentrated in software patching and system monitoring. Companies identified issues such as missing updates, inadequate oversight of systems no longer supported by their vendors, a lack of continuous monitoring and shortcomings in authentication or access controls. Each company submitted a plan for corrective action and had begun implementing measures to address its reported gaps.
Regulator proposes tougher security controls
The FSC is preparing a broader response covering both technical safeguards and management responsibility. Planned checks would examine companies’ connections to external systems, authentication procedures and access controls. The regulator also wants clearer accountability for chief executives, chief information security officers and chief information officers.
One proposal would require vulnerability assessments at least twice a year, initially for larger financial companies. The general requirement currently applicable to financial companies and electronic financial businesses is annual testing, while external websites are already subject to checks twice a year.
Regulators also plan to improve the speed at which companies share information about threats they detect. The proposed package includes the exchange of artificial-intelligence threat-level information, AI-based infrastructure for identifying vulnerabilities and additional security support for smaller companies. It also calls for stronger CEO accountability and more effective sanctions.
The FSC intends to speed up consideration of changes to rules separating computer networks, potentially making it easier for financial companies to use AI-based security defenses. However, the detailed scope and timetable for the inspections had not yet been finalized. The announcement also did not say whether every proposed measure would apply to virtual-asset businesses.
For cryptocurrency users, the inclusion of Streami and Pravang in the same regulatory disclosure as major banks highlights that digital-asset companies are being assessed as part of the wider financial system’s cybersecurity response. The release did not, however, provide company-specific figures or establish that the two crypto businesses faced the same type or scale of exposure as the banks named.
Current market picture
Moneyiar market data at 21:38-21:39 on October 15, 2026, showed declines across the four listed assets:
- Monad (MON): $0.0231524884, down 4.02% over 24 hours and 5.47% over seven days.
- Compound (COMP): $22.4131275102, down 1.23% over 24 hours and 3.91% over seven days.
- Nexus (NEX): $0.0000007385, down 4.47% over 24 hours and 7.33% over seven days.
- Comedian (BAN): $0.0532963935, down 0.10% over 24 hours and 12.53% over seven days.
These market figures describe price performance and do not indicate that the South Korean data-breach disclosures caused any of the reported moves.
