South Korea’s CBDC Pilot Faces Scrutiny Over Lack of Independent Security Audit

TLDR

• South Korea’s CBDC pilot skipped an independent government security audit.

• Participating banks largely relied on self-led security reviews before testing.

• No evidence showed external security checks after the CBDC pilot ended.

• Oversight concerns emerged as regulators advanced CBDC development plans.

• South Korea continues expanding CBDC and stablecoin initiatives despite scrutiny.

South Korea’s first central bank digital currency pilot has drawn attention after records showed no independent government security audit occurred during testing. Instead, participating banks completed most security reviews before the pilot began alongside selected cybersecurity organizations. Consequently, the findings have raised questions about oversight as authorities continue expanding digital payment initiatives.

Security oversight draws fresh attention

The Bank of Korea conducted the first phase of its retail CBDC pilot between April and June last year. The program tested digital currency infrastructure through Project Han River with several commercial banks. However, documents submitted by the Financial Supervisory Service revealed no separate government security inspection occurred during the pilot.

Before testing started, participating institutions completed an information technology security review and vulnerability assessment in February. Woori Bank and NongHyup Bank participated through their internal inspection teams. The Financial Security Institute and SK Shields also joined the pre-launch assessment process.

The review process has attracted criticism because participating banks helped assess systems they later tested. Moreover, available regulatory documents did not show evidence of an independent security audit after the pilot concluded. Therefore, questions have emerged over the level of external verification applied during the project.

Report highlights regulatory and supervisory gaps

The Bank of Korea later addressed security concerns in its published report covering the first real-transaction CBDC pilot. The report rejected claims that deposit tokens faced information technology security weaknesses. Instead, it stated that extensive system reviews occurred before Project Han River launched.

However, the available records did not indicate that an outside organization independently verified those security findings after testing ended. Consequently, the central bank’s conclusions relied mainly on reviews completed before the pilot. The absence of post-pilot external verification has therefore become a central point of discussion.

Regulatory coordination also appeared limited throughout the broader CBDC initiative. Financial Supervisory Service records identified only one formal consultation involving CBDC or deposit token products during three years. That consultation involved Shinhan Bank and an insurance product linked to deposit tokens.

CBDC development continues alongside stablecoin plans

The Bank of Korea stated that additional inspections during or after testing were unnecessary because comprehensive security reviews had already occurred. Furthermore, the central bank said the approach followed supervisory procedures established by the Financial Supervisory Service. Industry participants have nevertheless argued that independent audits would strengthen public confidence in future digital currency projects.

South Korea continues developing its digital payments framework while advancing stablecoin legislation and CBDC research. Earlier plans included expanding Project Han River with peer-to-peer transfers and broader merchant payment functions. However, preparations for the second phase paused after participating banks raised concerns about implementation costs and commercial viability.

Authorities have continued supporting blockchain payment initiatives despite those adjustments. Gyeonggi Province plans to launch a government-backed blockchain stablecoin pilot running from August through February 2027. Additionally, financial authorities recently introduced a roadmap covering won-backed stablecoins, institutional CBDC pilots, tokenized government bonds, deposit tokens, and participation in the Bank for International Settlements’ Project Agora. The Bank of Korea also maintains that deposit tokens remain separate from privately issued stablecoins because they represent commercial bank deposits operating on wholesale CBDC infrastructure.