The first pilot program for South Korea’s central bank digital currency (CBDC) was executed without a comprehensive independent security audit by the government. The banks involved primarily relied on their internal evaluations conducted prior to the test.
Summary
- The initial CBDC pilot in South Korea proceeded without an independent security inspection, depending instead on pre-launch assessments by the participating banks.
- Documentation from the Financial Supervisory Service indicates that no separate security audit was conducted during or after the pilot led by the Bank of Korea.
- The findings come as South Korea enhances its efforts on CBDCs, deposit tokens, and won-backed stablecoins as part of its digital asset strategy.
According to the South Korean daily Maeil Business, financial regulators did not carry out independent security evaluations during the first phase of the Bank of Korea’s CBDC pilot, which ran from April to June last year, based on information provided by the Financial Supervisory Service (FSS) to lawmaker Lee Heon-seung.
Prior to the pilot, the sole security assessment consisted of an IT security review and vulnerability analysis conducted in February. These evaluations were largely reliant on self-assessments by participating banks Woori Bank and NongHyup Bank, along with the Financial Security Institute and cybersecurity firm SK Shields.
This method raised concerns, as the banks involved were also responsible for evaluating the security of the systems they were testing. As reported by Maeil Business, there was no evidence of an independent government audit or external inspection occurring after the pilot concluded.
Concerns Over Independent Oversight
The report highlighted that the Bank of Korea later addressed security issues in its published findings related to the initial real-transaction CBDC pilot, following inquiries about the safety of deposit tokens used during the tests.
In a section titled “Misconceptions and Facts About Digital Currency,” the central bank refuted claims suggesting that deposit tokens were vulnerable to IT security issues. The Bank of Korea asserted it performed thorough security assessments throughout the system before launching Project Han River, the country’s CBDC trial.
However, Maeil Business argued that this defense underscored the central bank’s own review rather than showcasing outcomes from an independent third-party evaluation. Additionally, the newspaper noted that regulatory documents did not show that external auditors reviewed the system after the pilot’s conclusion.
The publication stressed that the absence of an independent review is significant, given that the pilot tested infrastructure that could be essential for South Korea’s future payment system. It underscored that conclusions regarding the lack of security concerns were based on assessments from entities directly involved in the project.
The report also pointed out inadequate supervisory coordination during the CBDC initiative, revealing that over the past three years, only one formal consultation took place between banking entities and regulators regarding CBDC or deposit token products, which involved Shinhan Bank and an insurance product associated with deposit tokens.
At the same time, the newspaper noted that banks have yet to establish dedicated teams focused on overseeing CBDCs and deposit tokens, raising additional questions about regulatory readiness as the pilot progressed.
In response to the criticisms, the Bank of Korea informed Maeil Business that further inspections during or after the pilot were viewed as unnecessary due to thorough security evaluations conducted before testing. The central bank claimed that this approach complied with supervisory protocols established by the Financial Supervisory Service.
An unnamed industry official quoted by the newspaper emphasized that real-world CBDC testing is vital not only for validating technology but also for building public trust. The official pointed out that relying heavily on project participants to assess and communicate the system’s security undermines the establishment of impartial credibility. They stressed that independent security assessments and external audits following the pilot would enhance market confidence.
Ongoing Evolution of CBDC Plans Alongside Stablecoin Initiatives
This report arrives as South Korea continues to redefine its digital payment strategy, with authorities striving to balance CBDC development alongside new policies supporting won-backed stablecoins.
The Bank of Korea initiated Project Han River as a retail CBDC experiment involving seven commercial banks, with initial plans aimed at expanding the second phase to include peer-to-peer transfers and merchant payments.
However, Bloomberg reported in June 2025 that preparations for the second phase were halted following concerns voiced by participating banks regarding implementation costs and the absence of a clear commercial model. The report also indicated that regulators were shifting their focus towards creating a legal framework for privately issued won-backed stablecoins in alignment with the proposed Digital Asset Basic Act.
Since then, government policy has continued to advance on both fronts.
Earlier this month, Gyeonggi Province announced the first government-backed blockchain stablecoin pilot in South Korea, expected to launch in August and last until February 2027. As reported by blockchain outlet NexBlock, the initiative will explore how a blockchain-based stablecoin can be issued, circulated, and settled, eventually assessing fraud prevention, privacy protections, and public-sector payment applications.
Separately, financial authorities unveiled a roadmap on July 19 to establish the Korean won as a freely convertible currency while introducing legislation governing the issuance and circulation of won-backed stablecoins.
According to the local publication Etnews, this roadmap was collaboratively drafted by the Financial Services Commission, the Bank of Korea, the Financial Supervisory Service, and the Korea Securities Depository. In addition to stablecoins, it outlines plans to broaden institutional CBDC pilot programs related to tokenized government bonds and deposit tokens, as well as facilitating participation in the Bank for International Settlements’ Project Agora for cross-border payment systems.
The Bank of Korea has maintained that deposit tokens function independently of privately issued stablecoins. Under its proposals, deposit tokens would represent commercial bank deposits on blockchain frameworks built atop the central bank’s wholesale CBDC system, enabling applications like government subsidies, public vouchers, and other digital payment services.
