Exchanges tighten liability waivers as regulators weigh no-fault compensation for crypto users

Virtual asset exchanges are revising their staking service terms to sharpen the scope of liability exemptions, even as financial regulators consider introducing a no-fault compensation requirement under the second phase of digital asset legislation — a divergence set to make liability standards for user protection a central policy battleground.

According to financial industry sources Thursday, Korbit recently amended the terms of service for its "Staking Plus" product. Staking refers to the practice of committing a user's virtual assets to a blockchain network's validation process in exchange for rewards, and all four major domestic exchanges offer related products.

The revised terms include a new clause stating that while the quantity of staked virtual assets is maintained in principle, it may decrease due to circumstances beyond the company's control — such as slashing, network errors or external hacking. The updated terms also specify that the company bears no liability for resulting losses unless they stem from the company's own intent or negligence.

Slashing refers to a penalty mechanism in proof-of-stake blockchain networks whereby a portion of a validator's staked coins is confiscated if the validator commits a protocol violation. For investors, this means that using a staking service through an exchange does not fully eliminate the inherent risks of the underlying blockchain protocol.

Korbit said the revision was intended to enhance transparency in service delivery. "Risks such as slashing are structural characteristics inherent to the protocol itself," a Korbit official said. "We updated the terms to improve clarity in line with the regulatory environment, which has tightened user protection and information disclosure obligations since the Virtual Asset User Protection Act took effect."

Exemption clauses covering potential withdrawal delays were also revised. The updated terms state that withdrawal processing may be delayed without company fault in cases where a surge in customer withdrawal requests strains the system or liquidity, or where withdrawal restrictions are required under applicable laws or at the request of investigative, judicial or government authorities. Korbit said the clauses reflect the company's legal obligations as a virtual asset service provider under anti-money laundering rules and the Act on Reporting and Using Specified Financial Transaction Information.

Korbit is not alone — all major exchanges include disclaimer clauses in their terms. Upbit informs users that staking rewards fluctuate depending on blockchain network conditions, that the company cannot intervene, and that reward levels are not guaranteed. Upbit also makes clear that the service does not qualify as a financial product protected under the Capital Markets Act or the Financial Consumer Protection Act.

Coinone stipulates that the value of assets under staking may rise or fall with market price movements and that any resulting losses are borne by the member. Bithumb similarly states it bears no responsibility for delays or impossibility in reward payments caused by changes in foundation policy, blockchain network errors or issues with node operators.

Separately from exchange terms, financial regulators are considering safety mechanisms as part of the second phase of digital asset legislation to bolster market confidence. A Financial Services Commission official said in a phone interview that the regulator "is reviewing the introduction of no-fault liability compensation" and that "provisions under the Electronic Financial Transactions Act will also be referenced." A second official said the second-phase bill is aimed at "refining market and operator discipline while at the same time strengthening user protection."

The backdrop to these discussions is Bithumb's Bitcoin overpayment incident in February. During a customer event reward distribution, Bithumb mistakenly sent out 620,000 Bitcoin. Of that amount, 1,788 Bitcoin entered the market as sell orders, pushing the price of Bitcoin — which had been trading around 95 million won (approximately $62,700) — down to as low as 81.11 million won at one point. The fallout also forced some users of Bithumb's coin lending service "Lending Plus" into liquidation as collateral values fell.

In March, the Financial Services Commission convened the "First Virtual Asset Committee of 2026" with related ministries and agencies — including the Ministry of Science and ICT, the Ministry of Economy and Finance, the Ministry of Justice and the Financial Supervisory Service — to discuss the Bithumb overpayment incident and the government's draft of the Digital Asset Basic Act. At the meeting, FSC Vice Chairman Kwon Dae-young said the commission would pursue policy along "two axes — institutional reform and market expansion — from the perspective of new governance and risk management." The meeting also raised the need to introduce safety mechanisms including internal control standards for exchanges and no-fault liability for damages.

The central question is how broadly no-fault liability would be defined. Article 9 of the current Electronic Financial Transactions Act requires financial companies to compensate users in principle for losses arising from forgery, alteration or accidents during electronic transmission and processing. Liability may be reduced only when the user's own intent or gross negligence is established — and the burden of proving that falls on the service provider.

Virtual asset service providers are not currently subject to the Electronic Financial Transactions Act, making it difficult to hold them to the same standard. But if the Digital Asset Basic Act adopts the no-fault compensation framework from that law, the situation could change significantly. Exchanges could face heavier liability than they do now when incidents occur in areas they are responsible for managing — such as hacking, system failures or internal control breakdowns.

South Korea has already seen large-scale user losses from virtual asset deposit services. Gopax operated its "GoPi" product through 2022, entrusting customer assets to global asset manager Genesis Global Capital. When Genesis filed for bankruptcy in the wake of the FTX collapse, repayment of GoPi users' claims was suspended. Unrecovered losses for GoPi investors are estimated to exceed 170 billion won.

Gopax originally offered both fixed-term and flexible GoPi services but has since suspended operations. However, because Binance agreed to cover interest payments on unredeemed GoPi deposits as part of its acquisition process, the cumulative deposit figure currently displayed on Gopax's website reflects both the assessed value of unredeemed deposits and accrued interest.

Legal experts say the enforceability of disclaimer clauses in exchange terms could shift depending on the direction of future legislation. "If an incident occurs despite all standard protective measures having been taken, the terms of service could serve as a supporting element in an exchange's defense," one legal expert said. The point is that if an exchange has fulfilled its duty to prevent incidents, its disclaimer clauses could provide grounds for contesting questions of intent or negligence.

However, the same expert cautioned that "if a major incident following the introduction of no-fault liability triggers a chain of damages, both the likelihood of compensation and the scale of damages could grow substantially."

Another expert said that "from an exchange's perspective, more specific terms are advantageous when asserting exemptions later, which is part of why they are refining their terms," but added that "if a no-fault liability clause is included or strengthened in the Digital Asset Basic Act, any revised terms that conflict with the law will be unenforceable to that extent."