On Friday 6 November 2026 Gopax, a South Korean crypto exchange, halted withdrawals at 14:55 in Seoul, which is 05:55 UTC, and halted trading at 15:53 in Seoul, which is 06:53 UTC. Yonhap’s account, carried by Malay Mail and by Aju, is that the exchange had received an email from people claiming to have broken in. A company official, not named in those reports, said the exchange had not yet verified whether the threat was real, and that it was putting customer assets first. Gopax said no loss of assets had been reported. This page did not open a notice on Gopax’s own site.
Gopax is an exchange. The number on the screen is a claim on the company. What is a crypto exchange balance?. The coins that can leave quickly sit in hot wallets, online. The exchange said it was moving most of what sat there into cold wallets, which are kept offline. That move is the company taking the till into the back room. It is not a finding that the till had already been emptied, and it is not a payment to a customer.
What happened
The reports agree on the shape. Withdrawals through the website and the app were switched off. Deposits of crypto were suspended. Trading stopped, and open orders were cancelled. Aju added that a customer can still ask support for a withdrawal, and that each request is handled by hand after an internal review. A manual desk is not the withdrawal button. As of 9:15 a.m. in Seoul on Saturday 7 November, which is 00:15 UTC, Aju said Gopax had posted no restart time.
Binance is described in the same coverage as Gopax’s majority shareholder. That is an ownership fact. It is not this incident. Binance puts the hot-wallet loss near $6.3 billion is a different company ledger, a different week, and a figure Gopax has not claimed. A freeze after an unverified email is not that theft, and it is not evidence that the email was true.
Why it matters
If your coins are on Gopax, you cannot use the ordinary withdrawal or the ordinary trade until the exchange says those are back. The company’s sentence is that nothing has been lost. That sentence is the company’s. It is not a chain receipt, and it is not a statement that will stay true if a later note contradicts it. If your coins are in a wallet whose keys you hold, this halt did not spend them.
An email that claims a hack is also a costume for the next message. Gopax’s own account, as quoted, is a precaution and a support desk. A message that needs a recovery phrase, a code, or a deposit to a new address “so the freeze can be lifted” is not that desk. See How do you keep crypto safe?. See How crypto wallets actually work if a login and a key are still the same object.
What happens next
A restart time, if Gopax publishes one. A later note that either confirms a loss or repeats that there was none. What happens to the coins that were moved offline, which is an operational choice and not a customer withdrawal. Watch Gopax’s own channels. We will not treat an unverified email as a completed theft, and we will not treat a move into cold storage as the customer made whole.
Not a recommendation to deposit, withdraw, or close a Gopax account. Not a finding that the email’s claim was true. Not a description of any access, because the exchange has not described one. The public account on Saturday morning was a halt, a transfer toward cold wallets, and a statement that no assets had been lost.
