Bank of Korea CBDC pilot skipped independent security audit, report says

Bank of Korea CBDC pilot skipped independent security audit, report says

South Korea’s initial test of a digital currency didn’t include a separate security check by the government. Instead, banks involved primarily checked the system themselves before starting the trial.

Summary

  • South Korea’s first CBDC pilot proceeded without an independent government security inspection, with pre launch reviews relying partly on participating banks.
  • Documents submitted by the Financial Supervisory Service show no separate security audit was conducted during or after the Bank of Korea’s pilot.
  • The findings come as South Korea continues expanding work on CBDCs, deposit tokens and won backed stablecoins under its digital asset roadmap.

According to a report in the Maeil Business newspaper, South Korea’s financial regulators didn’t conduct specific security checks during the initial testing phase of the Bank of Korea’s digital currency pilot program, which took place between April and June of last year. The information comes from data provided by the Financial Supervisory Service to lawmaker Lee Heon-seung.

Before the pilot program began, the only security measures taken were an IT security review and vulnerability assessment completed in February. This review involved teams from Woori Bank, NongHyup Bank, the Financial Security Institute, and the cybersecurity company SK Shields, who conducted self-inspections as part of the process.

As an analyst, I’ve found this arrangement concerning. The organizations involved in testing these systems also played a role in evaluating their security, which creates a potential conflict of interest. My review of the documents, including those from *Maeil Business*, revealed no record of an independent government inspection or external audit being conducted *after* the pilot program finished. This lack of independent verification is a key issue.

Report raises questions over independent oversight

Following some initial worries about the security of test deposits, the Bank of Korea clarified its findings in a public report detailing the results of its first real-world digital currency trial.

The Bank of Korea addressed concerns about the safety of digital currency in a recent statement. Specifically, they refuted claims that deposit tokens are susceptible to IT security threats. They explained that thorough security checks were completed throughout the system before beginning Project Han River, South Korea’s central bank digital currency testing initiative.

According to *Maeil Business*, the central bank’s explanation seemed more like a defense of its own internal review, rather than a presentation of results from an unbiased, external evaluation. The newspaper also pointed out that the documents provided by regulators didn’t prove that external security experts checked the system after the initial trial period.

The report highlights a key issue: the pilot program tested technology that might become part of South Korea’s payment system, yet it wasn’t independently reviewed. Furthermore, the claim that there were no serious security problems came from the groups actually working on the project, raising concerns about potential bias.

The report also highlighted a lack of communication between supervisors working on the digital currency project (CBDC). According to data from the Financial Supervisory Service, there was only one official discussion in the last three years about CBDCs or similar products between banks and regulators. This single consultation involved Shinhan Bank and a financial product connected to deposit tokens.

The newspaper also noted that banks haven’t created special teams to oversee central bank digital currencies (CBDCs) and deposit tokens. This lack of preparation raises concerns as testing continues.

The Bank of Korea addressed concerns by explaining to *Maeil Business* that further security checks during or after the trial run weren’t needed. They had already done thorough security testing before the trial began, and this approach aligns with standard procedures set by the Financial Supervisory Service.

According to a source in the industry, the goal of testing a central bank digital currency (CBDC) isn’t just to see if the technology works, but also to make sure people trust it. The source explained that having only those involved in the project assess its security isn’t enough to build strong, unbiased trust. They believe that getting independent security checks and external audits after the trial period will be crucial for boosting public and market confidence.

CBDC program continues to evolve alongside stablecoin plans

South Korea is updating its approach to digital payments. Officials are now weighing the benefits of creating a central bank digital currency (CBDC) alongside new rules for stablecoins that are backed by the Korean won.

South Korea’s central bank, the Bank of Korea, began a trial program called Project Han River to test a digital currency for everyday people. Seven commercial banks are participating. The next step of the trial was intended to allow people to send money directly to each other and make purchases at stores using the digital currency.

In my research, I discovered that in June 2025, Bloomberg reported the central bank paused work on the second phase of their digital currency project. Banks involved expressed worries about how much it would cost to put into practice and questioned whether there was a viable business plan for it. Simultaneously, regulators started focusing more on establishing legal rules for privately issued stablecoins linked to the won, as part of the planned Digital Asset Basic Act.

Government policy has continued developing on both fronts since then.

Gyeonggi Province in South Korea is launching a pilot program next month to test a new digital currency called a blockchain stablecoin. The project, which will run until February 2027, aims to explore how this type of currency can be created, used for transactions, and finalized. It will also investigate ways to prevent fraud, protect user privacy, and potentially use the technology for government payments, according to reports from NexBlock.

On July 19th, Korea’s financial regulators announced plans to allow the Korean won to be traded freely internationally. They also stated they will create laws to regulate new digital currencies – called ‘won-backed stablecoins’ – that use the won as their base value.

A recent report in *Etnews* details a joint plan developed by Korea’s financial authorities – including the Financial Services Commission, the Bank of Korea, the Financial Supervisory Service, and the Korea Securities Depository. The plan covers stablecoins and outlines expansions of pilot programs for central bank digital currencies (CBDCs), specifically linking them to tokenized government bonds and deposit tokens. Korea will also participate in Project Agora, an initiative by the Bank for International Settlements, to improve cross-border payment systems.

The Bank of Korea distinguishes between deposit tokens and privately issued stablecoins. It proposes that deposit tokens function as traditional commercial bank deposits, but utilize blockchain technology built on the central bank’s wholesale central bank digital currency (CBDC) system. This could enable more efficient digital payments for things like government benefits, public vouchers, and other services.

2026-07-21 10:44