Imagine waking up to find your hard-earned savings vanished overnight. Not because of a market crash, but because the platform holding them simply stopped working. That’s the reality for thousands of users who trusted GDAC, a South Korean cryptocurrency exchange that promised low fees and high speed before collapsing under the weight of a catastrophic security breach in April 2023.
If you’re digging into crypto history or wondering why some regional exchanges disappear while others thrive, GDAC offers a brutal lesson. It wasn’t just another failed startup; it was a functioning platform with real volume until hackers drained its hot wallet. This review breaks down what GDAC offered, how it failed, and what its demise teaches us about keeping your digital assets safe today.
The Quick Takeaway
- Status: Defunct. GDAC permanently ceased operations after an April 2023 hack.
- Main Appeal: Extremely low trading fees (0.20%) compared to global giants like Coinbase (2.00%).
- Fatal Flaw: A security breach exploited SIM swapping and social engineering, stealing ~$13 million (23% of custodial assets).
- User Impact: No compensation announced; funds remain inaccessible.
- Lesson: Even "legitimate" regional exchanges can fail if security protocols lag behind threats.
What Was GDAC? The Promise of Low Fees
Founded in 2018, GDAC positioned itself as a cost-effective alternative for South Korean traders. While major players charged hefty premiums, GDAC kept maker and taker fees fixed at 0.20%. For active traders, this difference added up quickly. If you were moving $10,000 a day, saving 1.8% per trade against competitors meant keeping hundreds of dollars in your pocket monthly.
The platform exclusively supported Korean Won (KRW), which made sense for its target demographic but limited its global reach. You couldn’t deposit USD or EUR directly. Instead, you needed access to KRW, effectively locking out most international investors unless they had specific banking arrangements in Korea.
Technically, the interface was built on TradingView infrastructure, providing charts and tools that many traders already recognized. It wasn’t reinventing the wheel, but it worked. Users reported stable transactions and a moderate learning curve, making it accessible to beginners while still offering depth for pros.
The Security Breach That Ended It All
In April 2023, the lights went out. Hackers didn’t just guess passwords; they executed a sophisticated attack combining SIM swapping and social engineering. By hijacking employee phone numbers and tricking support staff, attackers gained control over internal systems.
The result was devastating. Approximately $13 million worth of cryptocurrency-representing 23% of GDAC’s total custodial assets-was transferred from the exchange’s hot wallet to an unknown address. Hot wallets are online storage units used for frequent withdrawals. Keeping nearly a quarter of all user funds in one online bucket is risky even in good times. In GDAC’s case, it proved fatal.
| Feature | GDAC | Coinbase | Upbit (Korea Leader) |
|---|---|---|---|
| Maker/Taker Fee | 0.20% | ~2.00% | ~0.25% |
| Supported Assets | ~27 Cryptocurrencies | 136+ Cryptocurrencies | 150+ Cryptocurrencies |
| Fiat Currency | KRW Only | USD, EUR, GBP, etc. | KRW Only |
| Security Status | Breached (2023) | Insured/Robust | Robust/Audited |
Why did this happen? Post-mortem analyses pointed to gaps in employee training regarding phishing attempts and weak password management protocols. Unlike larger exchanges that employ dedicated security teams and conduct regular audits, mid-tier platforms like GDAC often cut corners to maintain their low-fee model. When the attack hit, there wasn’t enough redundancy to stop it.
Market Position and User Experience
Before the hack, GDAC held a niche position. It wasn’t trying to beat Binance globally. It aimed to win locally by being cheaper than Upbit or Bithumb. And for a while, it did. Trading volumes fluctuated wildly, hitting peaks of $84.8 million in late 2021, proving there was genuine demand for a cheaper Korean exchange.
User reviews were mixed even before the collapse. Some praised the stability and staking features, noting that fees for earning interest were below average. Others complained about customer support delays and a lack of referral bonuses. But these complaints seemed minor compared to the catastrophic loss that followed.
The platform’s decision to keep such a large percentage of assets in a hot wallet remains controversial. Most secure exchanges store the majority of funds in cold storage (offline wallets) and only keep a small fraction online for daily liquidity. GDAC’s approach maximized operational ease but minimized security resilience.
The Aftermath: No Compensation, Just Silence
After the breach, GDAC suspended operations immediately. Law enforcement got involved, but recovery efforts yielded little success. As of late 2025, there is no public record of significant fund recovery or restitution payments to users.
This silence is perhaps the worst part for victims. Imagine losing $500 or $50,000 without a clear path to getting it back. Reddit threads and archived Trustpilot reviews show profound frustration. Users felt abandoned. The exchange didn’t file for bankruptcy in a way that prioritized user claims transparently; it just faded away.
CoinMarketCap now lists GDAC as an "Untracked Listing," meaning it no longer reports data. Traders Union gave it a final score of 2.33 out of 10, reflecting its poor post-hack status. Expert Anton Kharitonov noted earlier that clients weren’t satisfied, but that dissatisfaction paled in comparison to the total loss experienced by those who held funds during the hack.
Lessons for Today’s Traders
So, what does GDAC’s story mean for you? If you’re currently using a smaller, regional exchange, ask yourself three questions:
- Where are my funds stored? Does the exchange publish proof-of-reserves showing most assets are in cold storage?
- How do they handle security incidents? Do they have insurance? What is their track record?
- Is the fee discount worth the risk? Saving 1% on fees might not be worth risking 100% of your capital if security is lax.
The industry mantra "Not your keys, not your coins" exists for a reason. Exchanges are convenient, but they are also single points of failure. GDAC proves that even a legally registered, transparent company with a physical address in Seoul can fail catastrophically if its security infrastructure doesn’t evolve with the threat landscape.
If you’re looking for alternatives in the Korean market, stick to the survivors: Upbit, Bithumb, Coinone, and Korbit. These platforms weathered the same regulatory storms and security threats that killed GDAC, largely because they invested heavily in compliance and security infrastructure earlier.
Is GDAC still operating?
No. GDAC permanently ceased operations following a major security breach in April 2023. It has been delisted from most major tracking platforms and shows no signs of reopening.
Can I withdraw my money from GDAC?
For most users, no. Following the hack, the exchange suspended withdrawals and eventually shut down. There have been no widespread announcements regarding successful compensation or refund processes for affected users.
What caused the GDAC hack?
Attackers used SIM swapping and social engineering to compromise employee accounts. They then accessed the exchange's hot wallet, transferring approximately $13 million (23% of total custodial assets) to external addresses.
Was GDAC regulated?
Yes, GDAC operated in South Korea, which has strict financial regulations. However, regulation does not guarantee immunity from technical security failures or sophisticated cyberattacks targeting operational weaknesses.
Why did GDAC have low fees?
GDAC competed on price, charging 0.20% maker/taker fees compared to higher rates on global exchanges. Critics argue that cutting costs may have extended to security investments, contributing to the platform's vulnerability.
