When Crypto Exchanges Should Resume Withdrawals After a Security Incident

A crypto exchange should resume withdrawals when it can verify the integrity of the signing and approval path it will use, reconcile customer balances against available assets, and process withdrawals within tested limits. If the evidence is stronger for some assets, networks or wallet groups than others, a staged reopening can reflect those differences. The decision should identify who can pause the reopened service and what would trigger that action.

On November 6, South Korean exchange Gopax suspended withdrawals as a precaution and said it was moving most assets held in online wallets to offline storage, Reuters reported. A few days later, a separate event showed how quickly the operating backdrop can change. The U.S. Bureau of Labor Statistics reported on November 10 that October consumer prices rose 0.4% on a seasonally adjusted monthly basis, above the 0.3% forecast in Reuters’ poll. U.S. stocks fell and Treasury yields rose after the release.

For an exchange planning a recovery exercise, a market move like this is a useful stress case. Operators may be clearing a backlog while treasury teams are repricing funding or moving collateral. See Reuters on Gopax, the October CPI release and Reuters on the market reaction.

Key Takeaways

• Reopening is a decision about what the exchange can verify, not a date on a calendar.
• Start with the exact asset, network, wallet and provider that will process the first withdrawals.
• Reconcile customer liabilities, custody balances and treasury movements at a common cutoff before releasing the queue.
• Treat the backlog as a ledger and queue problem, so an old request is never paid twice.
• Set pause triggers in advance and tie each one to a person or team with authority to act.
• Keep the test results with the approval to reopen so the decision can be reconstructed later.
  ‍

How Do You Verify the Path Funds Will Take?

Start with the exact combination of asset, network, wallet and provider that will process the first withdrawals. Establish which signing keys and approval policies are in use, how privileged changes are reviewed, and whether operators can observe the transaction through broadcast and confirmation. If the original incident involved a shared dependency, check which other routes still rely on it. A working test on one chain says little about a second route if its signer, policy configuration or custody connection differs.

Define the first set of transactions the team will observe end to end. A controlled withdrawal should show that the requested amount reached the intended destination, that the platform recognized the correct confirmation state and that the customer ledger updated as expected. Keep the test results with the approval to reopen so the decision can be reconstructed later. NIST’s incident response guidance provides a broader framework for planning recovery and incorporating what teams learn back into risk management. Read the NIST incident response guidance.

How Do You Reconcile Liabilities Before Releasing the Queue?

An onchain balance tells an operator what a wallet holds at a point in time. It cannot, on its own, say which customers are entitled to those funds or whether a withdrawal request has already been paid. Reconcile customer liabilities, custody balances and treasury movements at a common cutoff. Account for pending withdrawals, uncredited deposits, network fees and transfers between internal wallets. For amounts that remain unmatched, record what is known, who owns the investigation and which assets or queues are affected.

The backlog deserves the same scrutiny as the balances. A request may have been queued, signed or broadcast before withdrawals stopped. If its state is unclear, retrying it can create a duplicate payout. The team needs a reliable way to distinguish an old request that is safe to release from one that is already in flight. That is as much a ledger and queue-management problem as a wallet problem. Related reading on enterprise crypto wallet and custody.

How Should You Test a Reopening While Markets Are Moving?

A reopening exercise should include a burst of withdrawals, slower-than-expected network confirmations and a delay in replenishing an online wallet. Give the exercise a market shock so treasury and operations have to make decisions while prices are moving. Then ask whether the exchange can tell customers which withdrawals are available, show how long requests are waiting and continue to enforce normal approvals as the queue grows.

Decide in advance when to release another batch and when to pause again. Useful triggers include an unexplained reconciliation difference, confirmation times outside tested bounds or a custody provider that can no longer confirm transaction state. Tie each trigger to a person or team with authority to act. Include the external dependencies in the exercise, especially custody, liquidity and settlement services that may operate on different hours or respond at different speeds. ESMA’s custody resilience review specifically includes incident response and third-party dependencies. Read the ESMA custody resilience initiative.

How Do You Make the Reopening Decision Reviewable?

The decision record should identify what will reopen, who authorized it, what evidence they reviewed and when they will reassess. It should also state which routes remain paused and what their owners need to verify. A useful dry run ends with the operations lead being able to explain, from that record, why the first group of withdrawals can go through and what would cause the team to stop it again.

Alphapoint works with exchanges and financial institutions as a design partner on the operating controls around trading, liquidity and settlement. Discuss your operating requirements with Alphapoint.

Frequently Asked Questions

When should a crypto exchange resume withdrawals after a security incident?

When it can verify the integrity of the signing and approval path it will use, reconcile customer balances against available assets, and process withdrawals within tested limits.

Can an exchange reopen in stages?

Yes. If the evidence is stronger for some assets, networks or wallet groups than others, a staged reopening can reflect those differences, as long as the decision names who can pause the reopened service and what would trigger that action.

Why does the withdrawal backlog matter?

A request may have been queued, signed or broadcast before withdrawals stopped. Retrying one whose state is unclear can create a duplicate payout, so the team needs a reliable way to tell a safe request from one already in flight.

‍