South Korea crypto alliance mandates forced API key expiry

A major self-regulatory body for South Korea's cryptocurrency exchanges has introduced a new mandatory standard requiring platforms to forcibly expire API keys suspected of being improperly shared or loaned. The move by the Digital Asset Exchange Alliance (DAXA) aims to curb market manipulation and enhance security in one of the world's most active digital asset markets.

The policy mandates that member exchanges—Upbit, Bithumb, Coinone, Korbit, and Gopax—identify and revoke API credentials that show signs of unauthorized sharing. Once detected, these keys will be invalidated, cutting off access. The alliance developed the measure in consultation with members and regulators to address a loophole exploited in recent market abuse cases, though it has not disclosed the specific technical methods for detection.

Authorities are focusing on API key abuse due to the significant role of automated trading. According to data from the Financial Supervisory Service (FSS), automated bot trading accounts for approximately 30 percent of the total transaction volume in the South Korean market. While this activity provides liquidity, shared or leaked API keys present systemic risks, enabling...