Gopax Security Review: Analyzing the 2026 Account Access Incident

Gopax security review focuses on the limited account access incident that began in early September 2026 and came to light in October. The exchange confirmed that external parties viewed personal details of seven customers and two employees. No cryptocurrency or KRW withdrawals occurred.

Streami Inc., the operator majority-owned by Binance, holds a South Korean VASP license and ISMS certification. It lacks the fuller ISMS-P personal data protection certification held by several peer exchanges.

Gopax Licensing and Security Certifications

Gopax operates as one of five major KRW-trading platforms under regulatory oversight. The license covers KRW trading and custody services. Cold storage and multi-factor authentication form part of its standard controls.

Industry sources note that Gopax maintains historical ISO 27001 certification alongside current ISMS status. Regulators require larger firms to undergo vulnerability checks twice yearly. The absence of ISMS-P has drawn attention because it covers personal data handling more explicitly than basic ISMS.

Users evaluating exchanges often compare certification scope before depositing funds. Gopax has reported no prior major security incidents in public records prior to 2026.

Timeline and Scope of the Account Access Incident

Abnormal access began in early September 2026. Gopax identified signs of external viewing of nicknames and login histories only in early October. The exchange issued a public notice on October 16 confirming nine affected individuals.

Affected data included personal information of seven customers plus two current or former staff members. Regulators recorded roughly 100,000 total leak cases across 16 South Korean institutions during the same period, though no per-exchange breakdown exists. No account or card numbers enabling direct fraud were confirmed exposed at Gopax.

Attacks across the sector are suspected to involve AI-assisted methods. Gopax reported no evidence of asset losses as of mid-October 2026.

Response Actions and Ongoing Measures

After detection, Gopax applied account protections and blocked abnormal access. It notified affected individuals directly and filed reports with the Financial Supervisory Commission and Korea Internet & Security Agency. An external forensic investigation was launched.

The exchange issued user advisories on October 16 recommending avoidance of suspicious links and monitoring of accounts. Media coverage noted the two-day gap between the FSC disclosure on October 14 and the public apology. The CEO stated plans for stronger customer protection and IT system upgrades.

Industry-wide reviews continue, including potential AI-focused security probes. Users should monitor login activity and enable all available account protections while awaiting final investigation results.