Most cryptocurrency exchanges in South Korea lack personal information protection certification, and large platforms have insufficient investment in security According to the Korean media Decenter, a report from the Korean Internet Security Agency (KISA) shows that a large number of Korean cryptocurrency exchanges have not yet obtained ISMS-P certification, which is regarded as the minimum standard for personal information protection, and their security investment is also considered insufficient. Among the six non Korean won trading (Coin Market) exchanges that have newly registered and renewed virtual asset service providers (VASP) through the Financial Intelligence Unit (FIU) of the Financial Services Commission of Korea this year, five only hold basic ISMS certification. ISMS certification does not include personal information protection requirements. GOPAX has not obtained ISMS-P certification among the major exchanges that support Korean won trading. Large exchanges also face issues of secure investments and a shortage of dedicated personnel. The three major exchanges that have disclosed their information security status to the Korea Information Security Agency (KISA) - Upbit, Bithumb, and GOPAX - only allocate about 10% of their total IT investment to information security. In South Korea, the proportion of information security personnel in Upbit, Bithumb, and GOPAX is only 9%, 10.2%, and 12.5%, respectively. Coinone and Korbit, the third and fourth largest exchanges in South Korea, have not even voluntarily disclosed their information security measures.