Connect with us
DAPA Banner

Crypto World

South Korea crypto liquidity tumbles as stablecoin balances plunge 55% and stock heat up

Published

on

(Stablecoin holdings on Korean exchanges/Allium Labs compiled by Bradley Park)

Stablecoin balances in South Korea have fallen sharply since July even as stock inflows rise, underscoring a shift in where money is flowing.

The total amount of these so-called tokenized versions of fiat currencies held in wallets tied to South Korea’s five largest crypto exchanges have plunged 55%, with on-chain data pointing to a sharp wave of outflows triggered by the won’s break past 1,500 per dollar in mid-March.

Data from Allium Labs, tracking Ethereum and Tron wallets across Upbit, Bithumb, Coinone, Korbit, and GOPAX, shows that combined stablecoin holdings dropped from $575 million in July 2025 to roughly $188 million as of mid-March, with the decline accelerating as the won slid to 16-year lows against the dollar.

(Stablecoin holdings on Korean exchanges/Allium Labs compiled by Bradley Park)
(Stablecoin holdings on Korean exchanges/Allium Labs compiled by Bradley Park)

The timing suggests traders sold tether at elevated USD/KRW levels after the won weakened past 1,500 per dollar in mid-March, a threshold not seen since the 2008 financial crisis.

The weaker currency amplified the incentive to exit dollar-denominated holdings, with traders converting into won and redeploying into domestic assets, according to DNTV Research founder Bradley Park.

Advertisement

The outflows mark the latest phase of a broader migration of Korean retail capital from crypto into equities, a shift CoinDesk first documented in November. But where that earlier rotation was driven largely by narrative, with traders chasing AI-linked chipmakers as altcoin momentum faded, the latest drawdown appears tied to a specific FX trigger rather than a change in risk appetite.

South Korea’s government has since intensified efforts to attract capital into domestic markets through new policies such as “repatriation” accounts that offer up to 100% capital gains tax exemptions for investors who sell overseas assets and reinvest locally.

That shift is visible in brokerage data. Investor deposits, a proxy for cash available to buy stocks, fell from roughly ₩131 trillion ($86 billion) in early March to around ₩112 trillion ($74 billion) following the mid-month currency move, indicating that capital was being actively deployed into equities as stablecoin balances declined. Deposits have since begun to stabilize, suggesting fresh inflows are replenishing the pool of buying power.

(Korea Financial Investment Association)
(Korea Financial Investment Association)

The KOSPI, already up 75% in 2025, has gained another 37% this year, making it the world’s best-performing major index. The rally is highly concentrated, with Samsung Electronics and SK Hynix accounting for roughly half of market capitalization and more than 50% of projected profits, positioning them as the primary destination for both retail and institutional flows.

Broader stablecoin transaction volumes across Asia have ticked up over the last year, according to data from Artemis, suggesting the drawdown on Korean exchanges reflects domestic capital rotation rather than a region-wide pullback.

Advertisement
(Artemis)
(Artemis)

For crypto markets, the shift underscores the loss of one of their most important retail liquidity pools.

Korean participation has historically amplified market cycles, and the data now shows capital is not sitting idle but being actively redeployed. Whether those flows return may depend less on crypto narratives than on the sustainability of Korea’s equity rally.

A sharp correction, particularly in a market so concentrated in semiconductor stocks, could quickly force capital to rotate again. KOSPI has come under pressure recently as disruptions in oil transits through the Strait of Hormuz has sparked energy supply concerns.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

AI Routers Can Steal Credentials and Crypto

Published

on

AI Routers Can Steal Credentials and Crypto

University of California researchers have discovered that some third-party AI large language model (LLM) routers can pose security vulnerabilities that can lead to crypto theft. 

A paper measuring malicious intermediary attacks on the LLM supply chain, published on Thursday by the researchers, revealed four attack vectors, including malicious code injection and extraction of credentials

“26 LLM routers are secretly injecting malicious tool calls and stealing creds,” said the paper’s co-author, Chaofan Shou, on X.

LLM agents increasingly route requests through third-party API intermediaries or routers that aggregate access to providers like OpenAI, Anthropic and Google. However, these routers terminate Internet TLS (Transport Layer Security) connections and have full plaintext access to every message. 

Advertisement

This means that developers using AI coding agents such as Claude Code to work on smart contracts or wallets could be passing private keys, seed phrases and sensitive data through router infrastructure that has not been screened or secured.

Multi-hop LLM router supply chain. Source: arXiv.org

ETH stolen from a decoy crypto wallet 

The researchers tested 28 paid routers and 400 free routers collected from public communities. 

Their findings were startling, with nine routers actively injecting malicious code, two deploying adaptive evasion triggers, 17 accessing researcher-owned Amazon Web Services credentials, and one draining Ether (ETH) from a researcher-owned private key.

Related: Anthropic limits access to AI model over cyberattack concerns

The researchers prefunded Ethereum wallet “decoy keys” with nominal balances and reported that the value lost in the experiment was below $50, but no further details such as the transaction hash were provided. 

Advertisement

The authors also ran two “poisoning studies” showing that even benign routers become dangerous once they reuse leaked credentials through weak relays.

Hard to tell whether routers are malicious

The researchers said it was not easy to detect when a router was malicious.  

“The boundary between ‘credential handling’ and ‘credential theft’ is invisible to the client because routers already read secrets in plaintext as part of normal forwarding.” 

Another unsettling find was what the researchers called “YOLO mode.” This is a setting in many AI agent frameworks where the agent executes commands automatically without asking the user to confirm each one.

Previously legitimate routers can be silently weaponized without the operator even knowing, while free routers may be stealing credentials while offering cheap API access as the lure, the researchers found.

Advertisement

“LLM API routers sit on a critical trust boundary that the ecosystem currently treats as transparent transport.” 

The researchers recommended that developers using AI agents to code should bolster client-side defenses, suggesting never letting private keys or seed phrases transit an AI agent session.

The long-term fix is for AI companies to cryptographically sign their responses so the instructions an agent executes can be mathematically verified as coming from the actual model. 

Magazine: Nobody knows if quantum secure cryptography will even work