CoinGecko shows South Korea’s top exchanges saw an 89% YoY

CoinGecko historical volume data shows trading across South Korea’s five major won-based exchanges averaged about $305 million per day in a July 2026 window, down from $2.82 billion in July 2025. The drawdown hit as APAC regulators and enforcement bodies leaned harder on exchange disclosures, app distribution, and operational security controls.

Key Takeaways

Average daily volume across Upbit, Bithumb, Coinone, Korbit, and Gopax fell to about $305 million from $2.82 billion in comparable July seven-day windows, based on CoinGecko historical 24-hour readings.
Binance’s chief security officer said the exchange runs monthly simulated phishing tests via an internal red team, with remediation training for failures and termination as an option for repeat offenders.
India’s cybercrime agency ordered GitHub to disable access to three BitChat repositories within three hours, citing risks tied to shutdown circumvention and evasion of lawful surveillance. The Internet Freedom Foundation called the order unconstitutional.
Thailand’s SEC filed a criminal complaint against Bitkub and two former directors over alleged false disclosures linked to a 2021 cyberattack involving $50 million in assets.

Korea’s KRW Venues See an 89% YoY Volume Slide

CoinGecko historical 24-hour volume readings show a sharp contraction in South Korea’s core KRW spot venues. Comparing seven-day periods in July 2025 versus July 2026, combined average daily volume across Upbit, Bithumb, Coinone, Korbit, and Gopax fell about 89% to $305 million from $2.82 billion.

For traders, the magnitude matters more than the narrative. An 89% drawdown is large enough to treat South Korea as a reduced marginal source of spot volume versus a year ago, at least on this snapshot. That changes assumptions around where incremental liquidity and retail impulse flows are coming from when volatility picks up.

The packet’s framing also points to a competing attention trade. South Korea’s KOSPI benchmark more than doubled over the same period that crypto exchange volumes fell, a setup consistent with retail risk appetite rotating toward equities rather than feeding KRW crypto depth.

Security Posture at Major Exchanges: Binance’s Internal Phishing Drills

Binance chief security officer Jimmy Su said Binance has run simulated phishing attacks against its own employees monthly for the past four years, using an internal red team. A red team is an internal ethical-hacking group that simulates attacks to find weaknesses before real adversaries do. Simulated phishing is the controlled version of the most common credential-theft playbook: fake messages designed to see who clicks.

Su described the program directly: “We do phishing attacks on our own employees on a monthly basis just so we understand if our security hygiene is improving,” and added, “The ones that have failed it, we will do remediation training.” He also said staff who repeatedly fail can be fired.

That posture is consistent with where the threat has been clustering. AMLBot estimated 65% of crypto security incidents in 2025 were driven by social engineering, meaning attackers are often targeting people rather than software. The second-order effect is counterparty risk: exchanges are increasingly treating employee-targeted attack surfaces as a control plane, not an HR footnote.

APAC Enforcement and Compliance Pressure: India’s BitChat GitHub Order and Thailand’s Bitkub Case

India’s cybercrime agency ordered GitHub to disable access to three BitChat repositories within three hours, citing potential misuse to bypass internet shutdowns, evade lawful surveillance, and facilitate unlawful activities. The Internet Freedom Foundation called the order unconstitutional and warned it threatens free speech and open-source software.

BitChat is described as a decentralized messaging app that routes encrypted messages between nearby devices over Bluetooth without internet connectivity or centralized servers. Even so, the order targets a distribution layer that remains centralized in practice. That is the chokepoint risk: open-source tooling can be made harder to access quickly, even when the software’s design is decentralized.

In Thailand, the SEC filed a criminal complaint against Bitkub and two former directors, Sakolkorn Sakavee and Thaweesap Rawan, over alleged false disclosures linked to a 2021 cyberattack involving $50 million in assets. The complaint signals that governance and disclosure practices remain an enforcement focus for large local exchanges, especially with Bitkub’s parent described as considering a potential public listing.

The region is also seeing operational reshaping. HashKey Holdings merged HashKey Exchange and HashKey Global into a single platform and application spanning hubs including Hong Kong, Singapore, Dubai, and Bermuda, with compliance handled in the backend under local frameworks. That looks like optimization for multi-jurisdiction operations while keeping regulatory obligations localized behind the user-facing product.

Signals Traders Can Track From Here

The immediate tell on India’s BitChat action is whether GitHub complied, or has complied, with the three-hour disablement order and whether any legal challenge follows from the Internet Freedom Foundation’s objection.

On Korea, the cleanest signal is simply updated CoinGecko readings or exchange-reported volumes for the same KRW venues. The question is whether the roughly $305 million per day seven-day average persists, stabilizes, or reverses versus the July 2026 comparison window.

Thailand’s Bitkub case is procedural now. Traders can track next steps and public statements from Thailand’s SEC and Bitkub tied to the criminal complaint and the 2021 $50 million cyberattack disclosures.

HashKey’s merger also has practical edge. Rollout details across Hong Kong, Singapore, Dubai, and Bermuda, including any region-by-region access changes inside the single app, will show whether consolidation improves distribution or introduces new gating.

Marcus Hale’s Take: Liquidity, Access Risk, and the New APAC Playbook

I treat the Korea volume print as the anchor. A drop from $2.82 billion to $305 million in average daily volume across the five major KRW venues is not noise, it is a structural reduction in marginal spot liquidity unless the next CoinGecko windows show a clear reversal. The threshold that matters is whether KRW depth returns in size, because that is what changes how quickly global spot can absorb risk-on or risk-off impulses.

The real test is whether APAC’s tightening focus stays limited to enforcement headlines or starts to consistently hit distribution and disclosure rails. India’s three-hour GitHub order is the template for access risk at the code layer, while Thailand’s Bitkub complaint keeps governance and reporting in the enforcement crosshairs. If both persist while major venues harden internal controls like Binance’s monthly phishing drills, the setup starts to look structural rather than narrative-driven: thinner regional liquidity paired with more points of failure in access and compliance that can reprice counterparty risk fast.

Sources

Cointelegraph