Automated Order API Key Leased for Criminal Misuse... Virtual Asset Market Manipulation Reported to Prosecutors

Automated Order API Key Leased for Criminal Misuse... Virtual Asset Market Manipulation Reported to Prosecutors

Authorities "Refrain from Chasing Rapidly Surging Stocks"... Caution Urged Against Lending API Keys to Others

A suspect accused of maliciously using Application Programming Interface (API) keys, borrowed from others, to manipulate market prices in the virtual asset market through pre-set automated orders, has been referred to the prosecution.

The Financial Services Commission (FSC) held its 8th regular meeting on the 29th and resolved to report a total of two virtual asset market manipulation cases, including this one, to the prosecution.

Suspect A borrowed API keys from multiple virtual asset exchange accounts for a certain fee and sequentially placed high-priced buy orders between accounts to raise the price.

Subsequently, through repeated wash trading, they made it appear as if trading was active, and when general investors' buying interest came in, they sold most of their holdings to pocket trading profits.

Suspect B selected a specific virtual asset for market manipulation, actively pre-purchased tens of millions of won worth of the asset, and then concentrated market-manipulative orders in a short period to induce a price increase. Subsequently, they defended against price drops with dummy buy orders while selling, thereby acquiring tens of millions of won in illicit gains.

The FSC warned, "If one's API key lent to others is used for unfair trading or money laundering, the account holder may face civil and criminal liability, including being punished as an accomplice." It also emphasized that investors should refrain from chasing a particular asset if its price and trading volume surge without reasonable cause.

The authorities plan to strengthen the user order information collection and management system by making IP registration mandatory when issuing API keys and allowing API service access only through registered IPs. A system will also be established to identify high-risk accounts with a high possibility of improper API key lending.