- Report says BOK’s first CBDC pilot had no independent security audits.
- Security reviews relied mainly on self-assessments by participating banks.
- Project Hangang enters Phase 2 with nine banks and real subsidy payments.
The Bank of Korea’s first central bank digital currency (CBDC) pilot was carried out without formal inspections during or after the trial, according to data submitted by South Korea’s Financial Supervisory Service (FSS).
The only security checks conducted before the pilot began relied largely on self-assessments by participating banks, raising questions over independent oversight as the central bank prepares to expand the project.
The findings come just weeks before the Bank of Korea is expected to launch the second phase of Project Hangang, a larger CBDC pilot that will include nine banks, as many as 500,000 users, and real government subsidy payments.
Security Checks Relied on Self-Assessments
The first phase of the CBDC pilot ran for three months from April to June 2025 under the Bank of Korea’s leadership.
According to documents submitted to lawmaker Lee Heon-seung, financial authorities did not conduct separate inspections or audits while the trial was underway or after it concluded.
Before the pilot started, participating banks underwent a security review in February along with IT vulnerability assessments.
However, those assessments were largely performed by the banks themselves. Woori Bank and Nonghyup Bank carried out the reviews through their own inspection teams alongside the Financial Security Institute and SK Shielders, meaning the institutions operating the system were also responsible for evaluating its security.
The Bank of Korea later released its “First Actual Transaction Pilot Result Report,” acknowledging that concerns had been raised about the security of deposit tokens used during the project.
The report rejected those concerns, stating that the system had undergone thorough security reviews before the pilot began.
The submitted documents, however, did not show evidence of independent external audits or post-pilot security inspections. Critics argue that conclusions about the system’s safety came from the same organizations that designed and operated the pilot.
The Bank of Korea said it followed existing supervisory procedures and considered additional inspections unnecessary because pre-launch security checks had already been completed.
Second Phase Expands the CBDC Trial
Despite the criticism, Project Hangang is moving into a larger testing phase. Beginning in September, the Bank of Korea plans to expand participation from seven banks to nine by adding Kyongnam Bank and iM Bank.
The pilot could involve up to 500,000 users and, for the first time, distribute real government subsidies using tokenized bank deposits.
Unlike the first phase, which mainly tested payment infrastructure, the new trial introduces features designed for everyday banking. These include biometric authentication, person-to-person transfers, automatic conversion between bank deposits and deposit tokens, recurring payments, digital cash receipts, and interest payments.
The pilot will also test programmable payments, allowing government subsidy funds to be spent only at approved merchants, for approved purposes, and within defined time limits.
Low Usage in the First Pilot
The first trial attracted around 81,000 wallet users after running between April and June 2025. Although 81,000 people opened digital wallets, only about 42% actively used them. The pilot generated 114,880 transactions across roughly 12,000 merchants.
Banks reportedly spent around 30 billion to 35 billion won building the infrastructure for the first phase, while total payment volume reached about 692 million won. The results highlighted limited user engagement despite the technical success of the platform.
The Bank of Korea says the second phase is intended to address those issues by making digital payments function more like traditional banking services.
Related: South Korea Expands Deposit Token Plans With Banks and Sandbox Reforms
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
