South Korea has advanced a three-part digital-finance program covering crypto accounts for about 3,500 companies, legal recognition for tokenized securities, and deposit-token trials involving nine banks.

FACTBLOCK CEO and Korea Blockchain Week organizer Andrew Park said South Korea’s crypto market is moving away from its long reliance on retail trading as financial institutions focus on custody, tokenization, stablecoins, settlement systems and regulatory compliance.

The change covers three connected areas of financial activity. Corporate investors are preparing to enter the crypto market under Financial Services Commission rules, securities firms are building systems for tokenized assets, and the Bank of Korea is testing digital bank deposits that can carry programmable payment conditions.

South Korea prepares crypto accounts for 3,500 companies

Under a roadmap released by the Financial Services Commission in February 2025, South Korea planned to let about 2,500 listed companies and approximately 1,000 corporations registered as professional investors open real-name bank accounts linked to crypto exchanges.

Financial companies were excluded from the group, while access for the eligible corporations was designed as a controlled pilot rather than unrestricted participation.

Since 2017, Korean companies have been unable to trade virtual assets through local exchanges because banks have not provided the required real-name accounts. Although the restriction was not written as a direct statutory ban, the account rules effectively kept corporate money out of the market.

The FSC first opened limited account access to nonprofit organizations, universities, law-enforcement agencies, and crypto exchanges. Eligible institutions could sell virtual assets received through donations, criminal seizures, or exchange fees, but the first stage did not allow general investment.

Listed companies and registered professional investors formed the second group in the FSC’s roadmap because the regulator considered them better equipped to assess investment risk. Officials also cited corporate demand for blockchain businesses and digital-asset investments when choosing the pilot participants.

Subsequent guidelines considered an annual investment ceiling equal to 5% of a company’s equity capital, according to Korean media reports. Eligible purchases would be limited to the 20 largest cryptocurrencies by market value across South Korea’s five major exchanges, although regulators were still considering whether dollar-backed stablecoins such as Tether’s USDT should qualify.

Corporate access also creates demand for regulated custody. On Aug. 18, BitGo Korea secured VASP registration from the Korea Financial Intelligence Unit, allowing the company to develop crypto custody and transfer services for institutions and businesses.

Hana Financial Group owns 25% of BitGo Korea, while SK Telecom holds 10%. BitGo has not disclosed a service launch date, supported assets, custody fees, or named clients.

Tokenized securities enter South Korean law

Alongside corporate crypto access, South Korea has established a legal route for issuing and trading tokenized securities.

The National Assembly passed amendments to the Electronic Securities Act and Capital Markets Act on Jan. 15, 2026. The measures were promulgated on Feb. 3 and are scheduled to take effect on Feb. 4, 2027, according to a legal summary from Kim & Chang.

Under the amended Electronic Securities Act, distributed ledgers can serve as legally recognized records for securities issuance. Issuers must follow registration procedures involving the Korea Securities Depository, rather than treating blockchain records as a separate and unregulated ownership system.

Changes to the Capital Markets Act also bring investment-contract securities and fractional investment products into the regulated market. Licensed intermediaries will be able to handle distribution, while over-the-counter trading will operate under rules prepared by financial authorities.

Infrastructure work has proceeded before the law takes effect. As crypto.news reported in May, Samsung SDS won a contract to turn the Korea Securities Depository’s test system into a production-ready token-securities platform.

KSD expects the system to connect distributed-ledger data with its existing electronic securities accounts. The planned functions include issuance records, circulation checks, rights management and real-time monitoring of token volumes, with completion expected by February 2027.

In August, Shinhan Bank and Plume also began an offshore proof of concept involving a won-denominated tokenized fund backed by ultra-short-term bonds. The test excludes Korean residents and will not issue or distribute tokens, but the companies are examining whitelist controls, know-your-customer checks, anti-money-laundering procedures, and onchain operations before the domestic law begins.

For U.S. readers, the Korean structure differs in administration but follows the U.S. Securities and Exchange Commission’s position that putting a financial instrument on a blockchain does not remove it from securities law. In a January 2026 staff statement, the SEC divided tokenized securities into issuer-backed and third-party models and said market participants may still need registrations, proposals or regulatory relief.

SEC Commissioner Hester Peirce previously said “tokenized securities are still securities,” adding that distributors, buyers and trading platforms must consider federal disclosure and market rules. South Korea’s framework similarly places tokenized instruments inside its existing securities system, with KSD handling formal registration.

Project Hangang expands deposit-token testing

The Bank of Korea has developed a separate payment layer through Project Hangang, which combines wholesale central-bank money with deposit tokens issued by commercial banks.

Deposit tokens are digital versions of bank deposits rather than cryptocurrencies issued directly by the central bank to consumers. Participating banks issue the tokens to customers, while tokenized central-bank money settles transfers between the banks.

During Phase I, which began in April 2025, about 80,000 of the 100,000 invited users opened wallets. Participants completed approximately 118,000 payment transactions, although the total value remained below 700 million won.

In March 2026, the Bank of Korea launched Phase II with nine banks, adding BNK Kyongnam Bank and iM Bank to KB Kookmin, Shinhan, Woori, Hana, NH Nonghyup, IBK Industrial Bank and BNK Busan Bank.

Phase II includes person-to-person transfers, biometric payment approval, and automatic conversion between ordinary deposits and deposit tokens. The central bank is also extending digital vouchers and testing programmable controls on government spending.

Electric-vehicle charging infrastructure grants and public-sector operating expenses are among the first public-payment uses. Payment conditions can restrict which recipient spends the funds, where the money is accepted, and how long it remains available, according to the Bank of Korea.

A separate 9.6 billion won, or roughly $6.9 million, deposit-token payment program began in July under the Korea Internet & Security Agency and the Ministry of Science and ICT. Nine banks, eight payment companies, and two major merchants joined the consortium led by the Korea Financial Telecommunications and Clearings Institute.

The program will connect deposit tokens with existing payment networks, allowing merchants to process transactions without replacing all their terminals. Participating agencies said the test would examine whether the system can lower processing fees for small businesses.

AI agents gain a programmable payment method

Project Hangang’s technical work has also covered payments initiated by AI agents.

LG CNS demonstrated an agentic payment service in January 2026 using deposit tokens on the Bank of Korea’s infrastructure. Under the model, an AI agent can search for a product or service, check user-defined conditions, and complete a payment through a tokenized bank deposit.

The Bank of Korea said it would continue studying deposit tokens as a payment method for AI-agent services and as settlement money for tokenized bonds and shares. Because payment conditions can be written into the system, a transaction can execute only after a specified action or market condition occurs.

At the European Central Bank Forum in July, Bank of Korea Governor Hyun Song Shin said “the big prize is tokenizing government bonds.” Shin described a unified ledger where tokenized bonds, commercial-bank deposit tokens, and wholesale central-bank money could operate on the same platform.

The central bank has also connected Project Hangang with the Bank for International Settlements’ Project Agorá. In 2026, South Korea completed tests linking its digital-currency system with the cross-border platform, including real-value transactions using tokenized central-bank reserves across six currencies.

MANTRA Chain has resumed block production after deploying version 8.4.0 to fix a Cosmos-EVM vulnerability that kept its mainnet unable to process transactions for about 30 hours.

MANTRA Chain said in an Aug. 22 post that its mainnet was producing blocks again after developers fixed the vulnerability found in its Cosmos-EVM module.

The restart followed a coordinated software update involving MANTRA-operated validators and other members of the network’s validator set. According to the project’s incident status page, block production resumed at about 5:30 a.m. UTC on Aug. 22 through the patched v8.4.0 release.

User balances were not changed during the incident, while the restart involved no blockchain rollback or alteration of the network state, the status update said. Token holders were also told that they did not need to take any action.

MANTRA Chain halted after an attacker targeted its EVM module

The incident began late on Aug. 20, when MANTRA detected an attacker exploiting a vulnerability in an upstream software dependency used by the blockchain. Developers responded by halting the mainnet, preventing transactions from being processed while security teams investigated the activity.

MANTRA’s initial notice said all transactions and network endpoints had been frozen. The shutdown also stopped transfers, staking operations, bridges and MANTRA-managed inter-blockchain communication relays, while some exchanges paused deposits and withdrawals connected to the network.

As crypto.news reported on Aug. 21, the halt took validators, public endpoints and bridge services offline, leaving assets temporarily unable to move on the RWA-focused Layer 1.

Later in the investigation, MANTRA traced the vulnerability to its Cosmos-EVM module and said the activity affected two wallet addresses before developers contained the threat. Its status page subsequently identified them as MANTRA-managed wallets and said there was no indication that user, exchange, or partner funds had been directly affected.

“No user funds were exploited,” the project said in an update after identifying the source of the incident.

MANTRA has not disclosed what activity occurred in the two managed wallets, how much value was involved, or whether any assets left the addresses. The project also has not released the attack path or named the specific upstream software component responsible for the vulnerability.

Before beginning the restart process, the team took a complete snapshot of the blockchain at the halted state. Mainnet remained stopped at block 17,449,398 while developers reviewed known attack paths and prepared the patch.

Version 8.4.0 enabled the coordinated restart

Following the initial investigation, developers built v8.4.0 to repair the vulnerability in the EVM module and add supplementary security protections. MANTRA first tested the release on its DuKong testnet before validating it in an internal environment that replicated the mainnet state.

Repeated upgrade rehearsals were completed before validators received the signal to restart. According to the incident page, the software update did not require module changes, state migrations, or changes to the blockchain’s stored data.

MANTRA-operated validators were upgraded first, followed by validator partners, ordinary node operators, RPC services, and archive nodes. The team said it chose a coordinated restart because bringing back only part of the validator set could have created operational problems.

Block production returned roughly 30 hours after the last reported block was processed at about 11:13 p.m. UTC on Aug. 20. Public RPC and EVM endpoints later became operational, although the project warned that explorers, indexers and other services could lag while processing data created after the restart.

DuKong remained offline after the mainnet returned. MANTRA said work to restore the public testnet would continue over the next several days as engineers monitored mainnet stability.

The affected Cosmos-EVM component forms part of MANTRA’s system for running Ethereum-compatible smart contracts. In September 2025, the chain added EVM support alongside CosmWasm, allowing developers to deploy applications using either environment on the RWA-focused network.

Earlier Cosmos EVM flaw remains unconfirmed as the cause

The incident has drawn attention to a separate critical vulnerability disclosed by Cosmos Labs in March 2026. Security advisory ASA-2026-002 described an error in the ICS20 precompile, a component that allows EVM smart contracts to initiate cross-chain token transfers through the Inter-Blockchain Communication protocol.

According to the Cosmos EVM advisory, incorrect state handling during nested EVM execution could allow the same token balance to be used repeatedly within one transaction. The flaw led to an estimated $7 million loss on Saga EVM in January.

Cosmos Labs identified 15 chains running code containing the flaw. Six did not have the affected feature enabled, one was exploited, and the remaining networks applied a mitigation before an attack occurred, according to the advisory.

MANTRA was named among the teams that helped investigate and address the earlier issue. Cosmos Labs said the permanent repair was included in Cosmos EVM version 0.6.0 and that known affected chains had either upgraded or disabled the vulnerable component.

Neither MANTRA nor Cosmos Labs has said the Aug. 20 incident used the same ICS20 flaw. Until MANTRA publishes its technical report, attributing the latest exploit to that previously disclosed vulnerability would go beyond the available evidence.

MANTRA price hit a record low before the halt

During the hours surrounding the incident, the MANTRA token fell from approximately $0.005060 to a record low of $0.004126, a decline of about 18.5%. CoinGecko data cited in market reports placed the low at roughly 11:10 p.m. UTC on Aug. 20, minutes before the network’s last reported block.

Trading volume rose nearly 600% to approximately $24 million during the initial market reaction. MANTRA has not said the token selloff was related to the attack, leaving any link between the price movement and the incident unconfirmed.

Earlier in March, the token had risen 62% after MANTRA completed a rebrand, network upgrade, and 1:4 non-dilutive token split. Under the change, holders received four MANTRA tokens for every former OM token without altering the total value of their holdings at the conversion point, according to March market coverage.

For U.S. token holders using MANTRA’s native network, the chain halt prevented the same on-chain transactions, staking, and transfers that were unavailable in other regions. The project did not identify a separate impact on American users, and its confirmation that user balances remained unchanged applied to token holders generally.

MANTRA’s network focuses on tokenized real-world assets and is tied to several institutional projects. In June, Inveniam Capital Partners announced an agreement to acquire MANTRA and its affiliated entities after making a $20 million strategic investment in the company in August 2025, as detailed in the acquisition announcement.

The companies had also worked on NVNM Chain, a Layer 2 network built on MANTRA Chain for private-market asset data. MANTRA said a complete post-incident analysis covering the Cosmos-EVM vulnerability and the network’s response will be released in the coming days.

The Sandbox has contained a cross-chain bridge vulnerability that allowed an attacker to mint unbacked SAND on Base and BNB Smart Chain, with the project estimating the direct impact at less than 0.01% of the token’s 3 billion supply.

The Sandbox said it had fully contained the vulnerability affecting its SAND bridge on Base and BNB Smart Chain, adding that no user wallets were compromised and SAND held on Ethereum and Polygon remained secure.

In an August 22 statement, the metaverse project said the attacker created tokens on Base and BNB Smart Chain without the SAND needed to back them on Ethereum. The team disabled bridging to and from both networks, isolating the affected tokens and preventing them from being redeemed through the official bridge.

“All bridged SAND funds are backed by SAND locked on Ethereum, which remains entirely secure,” the project said.

Users were told not to buy, sell, or provide liquidity for SAND on Base or BNB Smart Chain while the affected deployments remain isolated. The team is also taking a snapshot from before the attack and said eligible liquidity providers would receive compensation, although it did not give a payment schedule.

How the SAND bridge exploit created unbacked tokens

Early on-chain alerts showed more than 500 million SAND minted on Base, but the reported figure climbed rapidly as the attacker continued interacting with the contract.

PeckShield later identified about 14.9 billion SAND created across two addresses. Other security researchers recorded hundreds of additional transactions, producing much larger estimates for the total number of unbacked tokens generated before the bridge was disabled.