The blockchain industry’s promise of transparency and accountability is being tested by recent enforcement actions. On 9 January 2025, South Korea’s Financial Intelligence Unit issued a preliminary sanction notice to Upbit following an on site inspection linked to its business license renewal. Local reporting cites approximately 500,000 to 700,000 suspected breaches of customer identification rules under the Act on Reporting and Use of Specific Financial Transaction Information. Potential penalties include a suspension that could restrict new customer onboarding and fines provided for in the statute.

 

Jan. 9, 2025. South Korea’s Financial Intelligence Unit issued a preliminary sanction notice to Upbit for alleged breaches of KYC and AML rules under the Act on Reporting and Use of Specific Financial Transaction Information.⚭ Images generated with AI.

Crypto Exchanges: A continuous pattern of Failure.

It is disappointing to see yet another case of a centralized crypto exchange (CEX) falling short of basic expectations.

In January 2025, regulators notified Upbit of preliminary sanctions after reviewing its license renewal. Reports indicate hundreds of thousands of suspected lapses in customer identification procedures. Under the Act on Reporting and Use of Specific Financial Transaction Information, penalties can include a suspension that limits onboarding of new customers and fines calculated under the statute. Upbit’s outsized role in Korea’s market means these actions carry system‑level consequences.

The alleged infractions are not trivial. Multiple outlets cite approximately 500,000 to 700,000 suspected breaches tied to customer identification. Even preliminary notices signal a gap between stated controls and operational practice. For a platform that handles the majority of domestic trading, culture and execution around compliance must be treated as core product work.

This pattern of continuous failure is unacceptable. It’s especially troubling because these failures are not decreasing as the industry matures; they seem to be increasing. Crypto exchanges must ask themselves: how can we expect trust in blockchain technology if the custodians of that technology continually betray it?

A History of Failures

The Upbit investigation is just the latest in a long string of scandals. Across the globe, centralized exchanges have repeatedly drawn regulatory scrutiny, fines, and criminal charges. Here are some of the most high-profile examples:

• Binance (USA): Fined $4 billion for systemic violations of the Bank Secrecy Act, with its CEO facing criminal charges and imprisonment.
• FTX (Global): Imploded in 2022 due to fraud and mismanagement, resulting in billions of dollars in customer losses and multiple executives facing jail time.
• Kraken (USA): Fined for failing to register as a securities broker, highlighting the lack of regulatory compliance even among top-tier exchanges.
• Binance (Australia): Investigated for misclassifying retail clients, exposing users to unnecessary risks and failing to comply with local regulations.
• Other Incidents: From exchange hacks to insolvencies, the industry is littered with examples of negligence and greed.

These failures not only harm investors but also damage the reputation of blockchain technology as a whole. Blockchain was designed to promote transparency, accountability, and trust. Yet, its primary custodians—the exchanges—are often its biggest violators.

Are CEXs feeling above the Law?

Centralized exchanges (CEXs) play a critical role in the crypto market. They are often the first touchpoint for new users and institutions entering the space. Yet, many of these companies operate as if they are exempt from the rules. There are several reasons why CEXs repeatedly fail to comply with regulations:

1. Profit Over Principles: The relentless pursuit of short-term gains drives exchanges to cut corners, compromising compliance and security.
2. Regulatory Arbitrage: Many exchanges establish operations in jurisdictions with lax oversight, assuming they can evade global standards.
3. Lack of Accountability: The decentralized ethos of blockchain has, ironically, allowed some centralized entities to believe they can operate without scrutiny.

This behavior is not sustainable. The longer exchanges continue to operate irresponsibly, the harder it will be for the industry to gain legitimacy.

Can CEXs actually follow the Rules?

The real question isn’t whether crypto can be saved—it’s whether centralized exchanges can follow the rules. The evidence so far is discouraging. While some exchanges have taken steps to improve compliance, the overall culture remains troubling.

Regulatory fines and jail sentences should be deterrents, but they often aren’t. Instead, these penalties are seen as the cost of doing business. This attitude undermines the credibility of the entire industry. If CEXs want to survive and thrive, they must:

1. Adopt a Culture of Compliance: Compliance shouldn’t be an afterthought. It must be embedded in the DNA of every exchange.
2. Invest in Solutions: There are countless tools and services available that make compliance easier. From KYC platforms to fraud detection systems, the technology exists—the willingness to use it doesn’t.
3. Lead by Example: The biggest players in the space must set the standard for others to follow. When leaders fail, the industry fails.

The survival of CEXs depends on their ability to adapt. If they don’t, decentralized alternatives may eventually replace them.

A Path Forward – Tools and Services to drive change.

The good news is that solutions exist. The technology and expertise required to make CEXs responsible and compliant are readily available. Companies like VaaSBlock are leading the charge by offering tools that make it easy for exchanges to do better.

At VaaSBlock, our RMA certification provides a comprehensive framework for assessing the credibility of blockchain projects. Exchanges that earn the RMA badge demonstrate a commitment to transparency, governance, and compliance. Beyond VaaSBlock, the market is full of tools and services that can help exchanges:

• Fraud Detection: Platforms that use AI to identify suspicious transactions in real-time.
• Compliance Solutions: KYC and AML tools that ensure exchanges meet regulatory requirements.
• Training Programs: Initiatives to educate employees about compliance and ethical business practices.

The resources are there. The money is there. What’s missing is the will to act.

“There is no excuse for this to be continuously happening” said Ben Rogers, CEO of VaaSBlock, “These companies are well-funded and have talented teams. The only possible explanation is culture, and it’s time for that to change.”

Conclusion: A Call to Action

The blockchain industry is at a crossroads. The original promise of blockchain—transparency, accountability, and decentralization—is at risk of being overshadowed by the failures of centralized exchanges.

The time for excuses is over. CEXs must step up and take responsibility. They must invest in compliance, adopt better practices, and lead by example. The survival of the industry depends on it.

If exchanges don’t change, the consequences will be severe. Trust will erode further, and the adoption of blockchain technology will stall. But if they rise to the challenge, they can rebuild trust and usher in a new era of credibility for blockchain.

The tools are there. The time is now. It’s up to the exchanges to decide which path they will take.

About VaaSBlock

⚭ This article has been co-created by VaaSBlock Consulting Team and our LLMs.

ℹ Sources: theblock.co | businesskorea.co.kr | yahoo.com | cointelegraph.com | koreatimes.co.kr | coinspeaker.com | justice.gov | thecorporategovernanceinstitute.com | sec.gov | asic.gov.au

What The Public Record Actually Shows About Upbit’s Failure Pattern

The defence offered by centralised exchanges after each incident follows a script. The breach was sophisticated. The response was prompt. Customer funds are safe or being made whole. The internal review is underway. Process improvements will follow. The script is so consistent across incidents and across exchanges that reading any single instance of it tells you almost nothing about what actually happened. The thing worth reading is the underlying public record — the regulatory filings, the court documents, the investigative journalism produced by reporters with access to insiders — and the public record on Upbit specifically tells a more uncomfortable story than the press statements do.

The public record shows a multi-year pattern in which the same categories of failure recurred under successive promises that the categories had been addressed. Hot-wallet exposure that was supposed to have been minimised was found, in subsequent incidents, to have been minimised on paper and not in operating reality. Customer-fund segregation that was claimed in regulatory disclosures was reconstructed, after the fact, to have been more theoretical than the disclosures implied. The pattern is not unique to Upbit. The pattern is unusually well-documented in Upbit’s case because Korean regulatory disclosure is more rigorous than most jurisdictions, and the Korean financial press has been more persistent in following the documents than the equivalent press in less-regulated markets.

The investigative read on this is that the script the exchanges run after incidents is not designed to inform customers. It is designed to manage the news cycle until the next incident reaches the news cycle of a different exchange and the attention moves on. The script works because the attention does move on. The pattern persists because the pattern is rewarded by the structure of how exchange failures are covered, not because exchanges are unable to address it.

The implication for any customer holding meaningful balances on a centralised exchange is the one the exchanges themselves would prefer customers not to draw: the public record across the last decade does not support the claim that the exchange model has improved its underlying failure pattern, only that the failures have become more sophisticated in their post-incident communications. The custody question that follows from the public record is whether the customer trusts the exchange’s operating reality, which is hidden, or the exchange’s communications, which are designed. Trusting the second has been a losing trade with predictable frequency.

None of this is investment advice or a specific recommendation against any specific exchange. It is, however, an investigative reading of what the documents actually say, and the documents say more than the press releases do. The documents are public. The reading is available to anyone who chooses to do it. The reason the reading is rare is that the documents are tedious. They are also where the truth, when there is truth, tends to live. Independent counterparty-diligence frameworks exist partly because the public record on exchange self-reporting has earned the scepticism that the public record now receives.

The brand-durability test for any institution is what happens when things go wrong — whether the trust deposited in better times survives the withdrawal that a failure event demands. Centralised exchanges, as a category, have made the opposite of that deposit. They have extracted trust through the convenience of custody and access while systematically failing to build it through transparency, operational accountability, or coherent incident response. The Upbit pattern is the category pattern in legible form: routine failures treated as exceptional events, regulatory scrutiny characterised as external interference rather than evidence of internal culture gaps, and a user base that remains primarily because the switching cost of moving to a more accountable alternative exceeds the cost of accepting the current risk. The market is correcting that calculus. Enforcement actions like the OKX MiCA compliance failure are evidence that regulatory tolerance for sustained self-regulatory theatre is shortening across jurisdictions simultaneously. The exchange that builds genuine operational accountability before the stress event will have options when the withdrawal comes. The exchange that discovers its brand is hollow during the withdrawal will not get a second chance to rebuild it in the same market.

The Commons-Governance Failure: Why Exchange Self-Regulation Repeats Ostrom’s Predicted Pattern

Elinor Ostrom’s Nobel-winning research on governing the commons identified the specific design principles that allow shared resources to be managed sustainably without either privatization or top-down state control: clearly defined boundaries, rules matched to local conditions, participation in rule-making by those affected, effective monitoring, graduated sanctions, and accessible conflict resolution. Applied to crypto exchange self-regulation, the failure pattern that repeats across Upbit and comparable exchanges maps precisely onto the absence of these principles rather than onto any single bad actor’s misconduct.

The trust that crypto exchanges depend on—user confidence that funds are segregated, that trading is not manipulated, that withdrawal requests will be honored—is a commons resource in Ostrom’s specific sense: no single user’s diligence can secure it, and it is degraded by the accumulated effect of many small violations that no individual participant has the power or incentive to police. Ostrom’s research found that commons management fails predictably when monitoring is delegated entirely to the resource users themselves without external verification, which describes almost every exchange trust framework prior to regulatory intervention. Security audit records like Bybit’s show what monitoring looks like when it is externally verified rather than self-reported—the difference in credibility is the Ostrom design principle made visible.

Graduated sanctions is the design principle most conspicuously absent from crypto exchange regulation as practiced. Ostrom found that commons systems fail when sanctions are either absent (violations go unpunished, encouraging further violations) or disproportionate (first-time minor violations trigger destruction of the resource itself, discouraging honest reporting). Crypto exchange enforcement has historically clustered at the disproportionate end: minimal consequence for years of accumulating small violations, followed by sudden, severe regulatory action once a threshold event forces intervention. What OKX’s enforcement record reveals fits this pattern: enforcement action arriving well after the violations that prompted it, which is consistent with a system lacking the graduated, proportionate sanctions Ostrom’s framework identifies as necessary.

The participation principle—that those affected by commons rules should have a voice in setting them—is structurally difficult in crypto exchange governance because the affected parties (millions of retail users across jurisdictions) have no practical mechanism for participating in rule design, unlike Ostrom’s studied commons systems (irrigation networks, fisheries) where the user population was small enough for direct participation. This absence is not necessarily fixable through more user input; it may require the accessible conflict-resolution and external-monitoring principles to substitute for direct participation, which is the direction regulatory frameworks are moving even when they do not describe themselves in these terms.

The RMA framework and comparable third-party verification structures function as an attempt to import Ostrom’s monitoring and boundary-definition principles into a system that otherwise lacks the small-group conditions her original research described. RMA versus ISO 27001 is directly relevant here: both are attempts to substitute externally verified, clearly bounded rule systems for the self-regulation that Ostrom’s framework predicts will fail at scale without them. The question her research would raise about any such framework is whether the monitoring is genuinely independent or whether it has been captured by the same actors whose behavior it is meant to constrain.

Ostrom’s broader finding—against both the pure privatization and pure state-control camps—was that successful commons governance is usually a hybrid: locally designed rules with external verification and legitimate enforcement authority. Industry standards coalition incentive alignment shows what happens when the hybrid tilts toward industry self-design without external verification: the coalition optimizes for signaling compliance rather than achieving it, which is the exact failure mode Ostrom’s design principles were meant to prevent. Upbit’s continuous failure pattern is not an outlier. It is what happens when a commons is managed without the structural conditions research has identified as necessary for it to be managed sustainably at all.