South Korea: AI-powered surveillance of crypto and stock market manipulation

The problem

South Korea has large, fast-moving stock and cryptocurrency markets, and trading volume is high. Reviewing that activity by hand is slow, and it has grown faster than investigators can keep pace with manually.

The scale of suspected wrongdoing has risen quickly. The number of suspicious cryptocurrency transaction reports filed by exchanges climbed from 199 in 2021 to 36,684 in the first eight months of 2025, more than the previous two years combined. Over the same period, from 2021 to August 2025, South Korea's customs service referred about 9.56 trillion won in crypto-related crimes, roughly $7.1 billion, to prosecutors.

Market manipulation takes several recognised forms. In a pump-and-dump scheme, a group buys a stock or token, spreads promotional or misleading messages online to push the price up, and sells once others have bought in. In spoofing, traders place large orders they do not intend to complete, creating a false impression of demand, then cancel them. In wash trading, connected accounts trade back and forth to inflate apparent volume. Some of this activity is automated, so orders can be placed and withdrawn faster than a person can follow.

The older monitoring tools depended on an investigator deciding in advance where to look. An analyst had to choose a time period to examine before running a search, so activity outside that period could pass unnoticed.

The solution

In early February 2026, South Korean authorities brought in two AI monitoring systems within days of each other, one for the stock market and one for cryptocurrency. Two bodies oversee financial markets in the country: the Financial Services Commission (FSC), which sets regulatory policy, and the Financial Supervisory Service (FSS), which carries out day-to-day supervision. The Korea Exchange (KRX) operates the national stock market.

For the stock market, the FSC and the Korea Exchange launched a monitoring system that began operating in February 2026. It analyses online content, including posts, reports of spam messages and videos, alongside live share-price data. It was built in response to a rise in coordinated promotion online through forums, social media and YouTube intended to move share prices. When the system flags a security, staff review it and open a fuller investigation where needed.

For cryptocurrency, the FSS upgraded its own platform, VISTA (Virtual Assets Intelligence System for Trading Analysis), which it had first built in 2024 to look into improper trading in virtual assets. The platform sorts through large volumes of trading data, flags unusual transactions and produces a visual picture of trading behaviour for investigators. The main change in the upgrade is how the system searches. The system now checks the whole trading record on its own. It examines every interval, from seconds to months, looking for patterns such as a sharp price rise and quick reversal, or a jump in trading volume with no clear cause. It then ranks the periods by how likely they are to involve manipulation, so investigators can begin with the highest-risk cases.

To run this, the FSS expanded its computing capacity, installing two new high-performance servers in December 2025 and setting aside a budget of 170 million won (about $117,000) for 2026. The servers use Nvidia H100 graphics processors, which are widely used for AI work.

Both systems keep a person in the decision. Each one flags and ranks activity, and people decide whether to investigate or step in.

The impact

1. Both systems are operational

The stock market system has been running since 3 February 2026. The upgraded cryptocurrency platform is in use, and the FSS describes VISTA as a core investigative tool in its enforcement cases.

2. The crypto system passed validation against past cases

The FSS tested the new detection model against closed investigations. It reported that the system identified every manipulation period investigators had previously found by hand, and flagged further periods that earlier methods had missed.

3. Real-time monitoring was added in May 2026

On 3 May 2026, the FSS announced a further upgrade that links the system to the public interfaces of crypto exchanges, both domestic and overseas, so it can continuously ingest market data rather than receive it once a day. The same upgrade automatically flags groups of accounts suspected of acting together, including accounts opened under borrowed names. The FSS said it developed the system in-house to offset limited investigative staff.

4. A pre-emptive freeze power is under consideration

The Financial Services Commission has been examining a mechanism to suspend transactions linked to suspected manipulation before an investigation concludes, to prevent suspected gains from being moved while regulators look into them.

Lessons learned

• Timely data matters as much as the model. Until 2026, the FSS received crypto market data only once a day, which limited how quickly it could respond. Its May 2026 upgrade connects directly to exchange interfaces, so data arrives continuously. Detection depends on the speed and quality of the underlying data feed, not the model alone.

• The technology flags and ranks; people still decide. Both systems are built to prioritise and surface activity, not to act on it. Staff assess what the stock system flags, and investigators work through the periods the crypto system ranks. Enforcement decisions stay with people.

• The system now searches the whole record, removing the need to guess where to look. The central change was removing the step in which an investigator had to define a time window before searching. The upgraded crypto system checks the entire trading record automatically, which the FSS says brought to light manipulation it had missed under manual review.

This case study was written with assistance from artificial intelligence.