South Korea's CBDC Pilot Skipped Independent Security Audit

The concern echoes work by Federal Reserve researchers Tarik Hansen and Katya Delak, who in 2022 flagged independent verification as a core design parameter for any national digital currency.

Phase 2 of Project Hangang received Financial Services Commission approval on July 15. The program expands to nine banks and up to 500,000 wallet holders. Individual wallet limits rise from 1 million won to 10 million won. New features include person-to-person transfers, biometric authentication, automatic top-ups, and programmable government subsidy payments.

Only 42% of digital wallet owners in Phase 1 completed a payment, Decrypt reported. Participating banks spent 30 billion to 35 billion won building the infrastructure.

The project uses a hybrid model: commercial banks issue deposit tokens on a blockchain, backed by wholesale CBDCs used between financial institutions. Bank of Korea digital currency planning chief Kim Dong-seop described the framework as "a middle ground between a CBDC and a stablecoin."

That design is drawing attention from other central banks. With South Korea preparing to push programmable government payments to half a million users starting in September, the absence of independent security verification shifts from a domestic concern to a precedent. How Project Hangang handled security could influence how other countries structure oversight as their own pilots move from controlled tests to everyday use.

A deposit token is a blockchain-based version of money already held in a bank account, issued by a commercial bank and backed by a wholesale CBDC that only financial institutions hold.