{"investigation":{"slug":"gdac","entity_name":"GDAC","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"GDAC was a South Korean cryptocurrency exchange operated by Peertec Co., Ltd. that launched in May 2018 and was registered as a Virtual Asset Service Provider (VASP) with Korea's Financial Intelligence Unit (KoFIU). On April 9, 2023, attackers drained approximately $13–14 million from its hot wallets — representing 23% of total custodial assets — causing the exchange to permanently shut down with no compensation offered to affected users.","sections":[{"content":"GDAC was a cryptocurrency exchange developed and operated by Peertec Co., Ltd., a blockchain fintech company incorporated in December 2017 and headquartered in the Gangnam-gu district of Seoul, South Korea. The exchange launched in May 2018, with a Korean Won (KRW) fiat market added in September 2018. Peertec was led by CEO Ash Han (Seunghwan Han), whose team included personnel drawn from Samsung, Kakao, and JP Morgan. The company's stated focus was wallet security, custody, smart contracts, and interoperability. Alongside GDAC, Peertec operated auxiliary products including PeerPay (crypto-to-fiat payments), Hashtower (custody and validation services), and GROW (a derivatives platform). GDAC held a VASP registration with KoFIU (Korea Financial Intelligence Unit) and had obtained an Information Security Management Systems (ISMS) certification from the Korea Internet and Security Agency (KISA), as required under South Korean virtual asset regulations. It was considered one of the top four exchange and custody providers in South Korea by sales and net profit prior to the 2023 hack.","heading":"Background","sources":[{"url":"https://peertec.com/we-are/","name":"","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/gdac-peertech","name":"","type":"other","credibility":3},{"url":"https://www.cryptowisser.com/exchange/gdac/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"At approximately 7:00 a.m. Korean Standard Time on April 9, 2023, an unidentified attacker gained unauthorized access to GDAC's hot wallet infrastructure and transferred approximately $13–14.2 million in crypto assets to external wallets under the attacker's control. The stolen assets comprised: approximately 60.8 Bitcoin (valued at roughly $1.7 million at the time), 350.5 Ether (approximately $652,800), 10 million WEMIX tokens (approximately $11.8 million), and 220,000 USDT. The stolen amount represented approximately 23% of the exchange's total custodial holdings. GDAC's CEO Seunghwan Han publicly confirmed the breach on April 10, 2023, one day after the incident. The exchange immediately suspended all deposits and withdrawals and shut down related servers. GDAC notified the Korea Internet & Security Agency (KISA), the Korea Financial Intelligence Unit (KoFIU), and the Korean National Police Agency, and requested cooperation from domestic and international exchanges and DeFi protocols to freeze the stolen assets. The precise technical vector was not officially confirmed in public disclosures; the exchange stated only that assets were transferred from its hot wallet to an unidentified wallet. Some secondary sources have alleged the attack involved SIM swapping and exploitation of weak two-factor authentication practices, though these specific claims have not been confirmed by official authorities or primary sources.","heading":"The Hack","sources":[{"url":"https://www.coindesk.com/tech/2023/04/10/s-korean-crypto-exchange-gdac-hacked-for-nearly-13m","name":"","type":"other","credibility":3},{"url":"https://www.financemagnates.com/cryptocurrency/south-korea-crypto-exchange-gdac-loses-23-of-assets-to-hackers/","name":"","type":"other","credibility":3},{"url":"https://decrypt.co/125834/hackers-rob-south-korean-exchange-13m-bitcoin-ethereum-other-assets","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/south-korean-crypto-exchange-gdac-hacked-for-nearly-14m","name":"","type":"other","credibility":3},{"url":"https://cryptoslate.com/korea-based-exchange-gdac-suspends-withdrawals-and-deposits-after-13m-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"GDAC operated under a VASP registration filed with KoFIU (Korea Financial Intelligence Unit), a unit of South Korea's Financial Services Commission (FSC). Registration required exchanges to hold an ISMS certification from KISA and use real-name verified bank accounts for fiat transfers between the VASP and its users. GDAC had satisfied these requirements at the time of the hack. Following the April 2023 breach and subsequent closure, GDAC was removed from the list of registered VASPs in South Korea. KoFIU later reported that the number of registered VASPs in South Korea declined from 42 to 31, with GDAC among those delisted alongside ProBit and Huobi Korea — exchanges cited as having struggled with regulatory compliance requirements including real-name banking relationships. No enforcement actions, fines, or criminal charges against GDAC's operators were identified in available public records as of the investigation date.","heading":"Regulatory Status","sources":[{"url":"https://www.chaincatcher.com/en/article/2166179","name":"","type":"other","credibility":3},{"url":"https://sumsub.com/blog/south-korea-crypto-and-travel-rule-regulations-all-you-need-to-know/","name":"","type":"other","credibility":3},{"url":"https://www.thekoreanlawblog.com/2024/10/registering-a-virtual-asset-service-provider-in-korea.html","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The April 2023 hack caused GDAC to permanently cease operations. Users were left with no compensation. Unlike larger exchanges such as Binance or Coinbase, GDAC maintained no insurance fund and had no third-party coverage arrangements for stolen customer assets. The exchange did not announce any recovery or restitution plan prior to closing. The stolen $13–14 million represented 23% of total custodial assets held on behalf of users, meaning a significant portion of customer funds was affected. The exchange did not provide public disclosure of how many users were impacted or the total value of customer balances held at the time of closure.","heading":"User Impact","sources":[{"url":"https://glavx.org/gdac-crypto-exchange-review-what-happened-and-why-it-failed","name":"","type":"other","credibility":3},{"url":"https://www.coinspeaker.com/gdac-deposits-withdrawals-14m-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"GDAC presents a critical risk profile due to: (1) a confirmed, large-scale hot wallet compromise that resulted in the loss of approximately 23% of all custodial assets; (2) permanent exchange closure following the breach with no user compensation; (3) subsequent delisting from South Korea's VASP registry; and (4) the absence of any insurance fund, recovery mechanism, or restitution plan. The exchange is no longer operational. Any funds held on GDAC at the time of closure are, for practical purposes, unrecoverable through exchange channels. The incident highlights the systemic risk of excessive hot wallet concentration — GDAC held a disproportionate share of user funds in internet-connected wallets — as well as the absence of custodial insurance that more established exchanges maintain. GDAC should be treated as a defunct and uncompensated-loss event. No ongoing business relationship or deposit activity is possible.","heading":"Risk Assessment","sources":[{"url":"https://www.coindesk.com/tech/2023/04/10/s-korean-crypto-exchange-gdac-hacked-for-nearly-13m","name":"","type":"other","credibility":3},{"url":"https://www.financemagnates.com/cryptocurrency/south-korea-crypto-exchange-gdac-loses-23-of-assets-to-hackers/","name":"","type":"other","credibility":3},{"url":"https://www.chaincatcher.com/en/article/2166179","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2017-12","event":"Peertec Co., Ltd. incorporated in Seoul, South Korea.","source":""},{"date":"2018-05","event":"GDAC cryptocurrency exchange launches.","source":""},{"date":"2018-09","event":"GDAC opens Korean Won (KRW) fiat trading market.","source":""},{"date":"2023-04-09","event":"Attackers drain approximately $13–14.2M from GDAC hot wallets at 7:00 a.m. KST, stealing ~60.8 BTC, 350.5 ETH, 10M WEMIX, and 220,000 USDT — 23% of total custodial assets.","source":""},{"date":"2023-04-10","event":"GDAC CEO Seunghwan Han publicly confirms the breach. Exchange suspends all deposits and withdrawals. KISA, KoFIU, and Korean National Police Agency are notified.","source":""},{"date":"2023-04","event":"GDAC permanently ceases operations. No compensation plan announced for affected users.","source":""},{"date":"2025-02","event":"KoFIU confirms GDAC has been removed from the South Korean VASP registry, alongside ProBit and Huobi Korea.","source":""}],"sources_used":[{"url":"https://peertec.com/we-are/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829140919/https://peertec.com/we-are/","credibility":3,"archive_timestamp":"2026-08-29T14:09:19+00:00"},{"url":"https://www.crunchbase.com/organization/gdac-peertech","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cryptowisser.com/exchange/gdac/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251212161725/https://www.cryptowisser.com/exchange/gdac/","credibility":3,"archive_timestamp":"2025-12-12T16:17:25+00:00"},{"url":"https://www.coindesk.com/tech/2023/04/10/s-korean-crypto-exchange-gdac-hacked-for-nearly-13m","name":"","type":"other","archive_url":"http://web.archive.org/web/20260725170101/https://www.coindesk.com/tech/2023/04/10/s-korean-crypto-exchange-gdac-hacked-for-nearly-13m","credibility":3,"archive_timestamp":"2026-07-25T17:01:01+00:00"},{"url":"https://www.financemagnates.com/cryptocurrency/south-korea-crypto-exchange-gdac-loses-23-of-assets-to-hackers/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830005228/https://www.financemagnates.com/cryptocurrency/south-korea-crypto-exchange-gdac-loses-23-of-assets-to-hackers/","credibility":3,"archive_timestamp":"2026-08-30T00:52:28+00:00"},{"url":"https://decrypt.co/125834/hackers-rob-south-korean-exchange-13m-bitcoin-ethereum-other-assets","name":"","type":"other","archive_url":"http://web.archive.org/web/20260308233259/https://decrypt.co/125834/hackers-rob-south-korean-exchange-13m-bitcoin-ethereum-other-assets","credibility":3,"archive_timestamp":"2026-03-08T23:32:59+00:00"},{"url":"https://cointelegraph.com/news/south-korean-crypto-exchange-gdac-hacked-for-nearly-14m","name":"","type":"other","archive_url":"http://web.archive.org/web/20260725170056/https://cointelegraph.com/news/south-korean-crypto-exchange-gdac-hacked-for-nearly-14m","credibility":3,"archive_timestamp":"2026-07-25T17:00:56+00:00"},{"url":"https://cryptoslate.com/korea-based-exchange-gdac-suspends-withdrawals-and-deposits-after-13m-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260313144753/https://cryptoslate.com/korea-based-exchange-gdac-suspends-withdrawals-and-deposits-after-13m-hack/","credibility":3,"archive_timestamp":"2026-03-13T14:47:53+00:00"},{"url":"https://www.chaincatcher.com/en/article/2166179","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829145329/https://www.chaincatcher.com/en/article/2166179","credibility":3,"archive_timestamp":"2026-08-29T14:53:29+00:00"},{"url":"https://sumsub.com/blog/south-korea-crypto-and-travel-rule-regulations-all-you-need-to-know/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260807203001/https://sumsub.com/blog/south-korea-crypto-and-travel-rule-regulations-all-you-need-to-know/","credibility":3,"archive_timestamp":"2026-08-07T20:30:01+00:00"},{"url":"https://www.thekoreanlawblog.com/2024/10/registering-a-virtual-asset-service-provider-in-korea.html","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829154707/https://www.thekoreanlawblog.com/2024/10/registering-a-virtual-asset-service-provider-in-korea.html","credibility":3,"archive_timestamp":"2026-08-29T15:47:07+00:00"},{"url":"https://glavx.org/gdac-crypto-exchange-review-what-happened-and-why-it-failed","name":"","type":"other","archive_url":"http://web.archive.org/web/20260314143227/https://glavx.org/gdac-crypto-exchange-review-what-happened-and-why-it-failed","credibility":3,"archive_timestamp":"2026-03-14T14:32:27+00:00"},{"url":"https://www.coinspeaker.com/gdac-deposits-withdrawals-14m-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260412231436/https://www.coinspeaker.com/gdac-deposits-withdrawals-14m-hack/","credibility":3,"archive_timestamp":"2026-04-12T23:14:36+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:42.827763+00:00","updated_at":"2026-08-30T01:16:31.476171+00:00"}}