South Korea’s Crypto Crackdown Falters on Vague Rules as DeFi Exploit Exposes $1.5M Gap

Regulators cannot penalize crypto firms for failing to follow rules that aren’t clearly written. The Seoul Administrative Court ruled that South Korea’s Financial Intelligence Unit lacked the legal foundation to suspend Upbit operator Dunamu, because the anti-money laundering guidelines for small transactions were too vague to enforce. Though Dunamu had flagged over 600,000 suspected Know Your Customer violations and facilitated transfers with unregistered overseas providers, the court found no evidence of gross negligence—only that the company operated under unclear mandates. The suspension, imposed on February 25, 2025, blocked new users from moving digital assets. But the court concluded that without specific compliance directives, regulators could not justify the penalty. An earlier injunction on March 27, 2025, had already allowed Upbit to resume onboarding users. This final decision sets a precedent: enforcement fails when rules are high-level and operationally ambiguous. At the same time, a separate incident revealed structural risk in decentralized systems. On Hyperliquid, an attacker opened a $15 million long position in the memecoin FARTCOIN across multiple wallets, then manipulated the price in a thin market to trigger forced liquidation. The platform’s auto deleveraging mechanism—designed to manage counterparty risk—shifted the $1.5 million loss to the shared liquidity pool instead of individual traders. The attacker hedged the position with shorts on other exchanges, pocketing gains while the protocol absorbed the cost. No smart contract was breached, and user funds outside the pool remained safe. But the exploit exposed how incentive misalignments can be weaponized. Hyperliquid is now reviewing changes to its risk parameters and liquidity thresholds for volatile assets.