South Korea's CBDC Pilot Lacks Independent Security Audit, Report Reveals

South Korea’s first retail CBDC pilot moved ahead without an independent government security audit, according to a report that is likely to intensify scrutiny of the central bank’s testing approach. What happened - Maeil Business, citing data the Financial Supervisory Service (FSS) submitted to People Power Party lawmaker Lee Heon-seung, says the Bank of Korea’s initial CBDC pilot (Project Han River) — run April–June 2025 — proceeded without a separate, external security inspection. - The only pre-launch security work appears to have been an IT security review and vulnerability assessment performed in February 2025. Those reviews relied in part on self-inspection teams from participating lenders Woori Bank and NongHyup Bank, the Financial Security Institute and cybersecurity firm SK Shields. - Maeil Business reports there is no documentary evidence that an independent government audit or third-party security review was performed after the pilot concluded. Why critics are alarmed - The pilot tested infrastructure that could eventually underpin parts of South Korea’s payments system. Critics say allowing project participants to help evaluate systems they used undermines objective verification of safety. - Maeil Business argues the Bank of Korea’s published rebuttal — which says deposit tokens are not vulnerable to IT security risks and that extensive pre-launch reviews were completed — amounts to defending internally produced checks rather than presenting independent findings. - An unnamed industry source told the paper that real-world CBDC testing must do more than validate technology; it must build public trust. Independent security verification and post-pilot external audits, the source said, would strengthen market confidence. Regulatory coordination and preparedness - The FSS data also showed limited supervisory engagement: over three years, regulators held just one formal consultation with a bank (Shinhan) on CBDC or deposit token products. - Participating banks reportedly have not established dedicated teams focused on CBDC or deposit token supervision, raising questions about regulatory readiness as the pilot progressed. Bank of Korea response - The central bank told Maeil Business additional inspections during or after the pilot were unnecessary because it completed comprehensive security checks before testing and followed supervisory procedures set by the FSS. - The Bank of Korea’s public report on the pilot defended the security of deposit tokens and described the scope of internal reviews, but it did not present evidence of independent post-pilot audits, according to the newspaper. Bigger picture: CBDC vs stablecoins and next steps - Project Han River began as a retail CBDC experiment with seven commercial banks; earlier plans for a second phase to include peer-to-peer transfers and merchant payments were put on hold. Bloomberg reported in June 2025 that the central bank paused preparations for phase two after banks raised concerns about implementation costs and the lack of a clear commercial model. - Regulators are simultaneously advancing policy for privately issued won-backed stablecoins. Lawmakers and agencies are working on a Digital Asset Basic Act and other legal frameworks. - Recent initiatives include a government-backed blockchain stablecoin pilot announced by Gyeonggi Province, slated to run August–February 2027, which will test issuance, circulation, settlement, fraud prevention, privacy and public-sector use cases (reporting by NexBlock). - On July 19, financial authorities unveiled a roadmap — prepared by the Financial Services Commission, the Bank of Korea, the FSS and the Korea Securities Depository, according to Etnews — that envisions making the won freely convertible and creating legislation for won-backed stablecoins. The roadmap also calls for expanded institutional CBDC pilots tied to tokenized government bonds and deposit tokens and for participation in the BIS’s Project Agora on cross-border payment infrastructure. Where deposit tokens fit in - The Bank of Korea maintains deposit tokens are distinct from privately issued stablecoins. Under the central bank’s model, deposit tokens would represent commercial bank deposits on blockchain rails built atop the central bank’s wholesale CBDC system. Potential uses include government subsidies, public vouchers and other digital payment services. Implication - The controversy underscores a familiar tension in digital currency policy: how to rigorously test and scale new payment infrastructure while ensuring independent oversight and public trust. With CBDC pilot work, parallel stablecoin policy moves, and local experiments underway, South Korea is advancing quickly — but questions about audit transparency and regulatory coordination may shape how smoothly those efforts proceed.