On Oct. 6 the KOSPI closed at 6,941.39, down 62.35 points (0.89%). Foreign investors sold a net 1.7509 trillion won on the main board (1.7689 trillion won for KRX and NXT combined); by volume they sold 15.16 million Samsung Electronics shares and 6.73 million SK hynix shares. Samsung Electronics fell 1.45% to 272,000 won and SK hynix 3.69% to 1,773,000 won. Individuals bought a net 740.6 billion won; institutions sold a net 2 billion won. The same day the Kosdaq rose 26.63 points (2.98%) to 919.92. Secondary batteries, pharma and biotech, materials, parts and equipment, and cybersecurity themes gained, with foreigners buying a net 109.4 billion won and institutions 100.2 billion won. The won closed at 1,343.6 per dollar, down 0.4 won.
Who sold matters more than the number 7,000. KOSPI 7,000 is an index two chip stocks carried up. When foreigners dump 1.75 trillion won of those two in a day, the index comes right back down. The Kosdaq, with little chip weight, rises when the money moves across. Today was not the day Korean stocks fell. It was the day money left chips and went somewhere else.
If you hold a chip ETF, Samsung Electronics or SK hynix, today's loss was visible on your screen; if you hold Kosdaq growth stocks, the opposite. The won barely moved. Foreigners sold but the won did not weaken, which means the proceeds have not yet left in dollars or went into other Korean assets. There is no basis yet for reading this as foreigners leaving Korea.
Most of this year's KOSPI gain came from two chip stocks. A 1.75 trillion won sale in one day may be the start of profit-taking, and an index that leans on two names falls fast when it falls.
Foreigners bought on the Kosdaq. They did not sell Korea; they switched stocks. Calling a trend from one day's flows after a holiday is premature. 7,000 is a number the index can touch again.
The number to remember today is not 6,941 but 1.7509 trillion won. If foreigners sell again tomorrow, it is a trend; if they buy, it was noise. Until then the headline '7,000 collapses' means as little as yesterday's '7,000 breached.' The index is the mood of two stocks; your account is a matter of what you hold.
Newspim "KOSPI closes at 6,941.39" and "Kosdaq closes up 2.98%" · Seoul Shinmun · eToday · Money Today [Spot] · Business Korea · ET News (NXT combined figure) · Kangwon Domin Ilbo (all 10/6) · direct check against KRX primary data not completed
EconomyPress ✓ 6 outlets · exchange figures as reported
Foreigners sold 1.75 trillion won in a day. 7,000 was gone in a day
KOSPI 6,941.39 (−0.89%), Kosdaq 919.92 (+2.98%). Foreign net selling of 1.7509 trillion won is the main-board figure
On the first trading day after the holiday, the KOSPI touched 7,000 in early trading, slid straight back and closed down 62.35 points at 6,941.39. Foreign investors sold a net 1.7509 trillion won on the main board (1.7689 trillion won including the alternative exchange NXT). The selling came down to two stocks: Samsung Electronics (272,000 won, −1.45%) and SK hynix (1,773,000 won, −3.69%). Individuals absorbed 740.6 billion won; institutions all but sat it out (−2 billion won).
At the same hour the Kosdaq rose 2.98% to 919.92. Secondary batteries, pharma and biotech, materials, parts and equipment, and a cybersecurity theme riding the bank-hacking news. Here foreigners (+109.4 billion won) and institutions (+100.2 billion won) bought together. Money that had crowded into chips changed seats within a single day.
Unfold the story and DailyDrop's take
By the numbers
1.7509 trillion wonForeign net selling (main board). KRX+NXT combined: 1.7689 trillion won
−3.69%SK hynix at 1,773,000 won. Samsung Electronics −1.45%
+2.98%Kosdaq 919.92. Foreigners and institutions both net buyers
Financial regulators shared with the industry the attacker IP address used in the hacks of Shinhan, KB Kookmin, Hana and BNK Busan banks, Yegaram and Welcome savings banks, and Hyundai Capital. When firms checked their security logs, the same IP showed up trying to reach Toss Bank's servers 14 times between January and August this year, KakaoBank six times in simple access attempts in January and March plus one vulnerability scan on Sept. 29 (blocked), and Kbank four times since July. The three internet-only banks say they detected and blocked the abnormal access and that no systems were compromised and no customer data leaked. An access attempt is not a breach, and the same IP cannot be assumed to be the same attacker.
The picture is of one IP that knocked on every bank it could find. Whether the difference between the breached and the unbreached was luck or skill becomes the central question of this case. And the fact that an IP active since January became known to the whole industry only in October means attack intelligence began to circulate only after the damage was done.
If you bank with one of the three, there is nothing you need to do right now. But 'no damage' is not 'no attempt.' If you reuse a password across services, change it, and turn on login alerts in your banking app. Those are the things worth doing every time news like this appears.
All three internet-only banks held the line, which is evidence that security spending worked. Lumping the unbreached under the same headline as the breached is an exaggeration.
Blocking it is good, but while seven firms were breached, a single attack IP was never shared across the industry. The question is not each bank's skill but how fast regulators share information.
The reassuring part of this story is 'blocked.' The uncomfortable part is 'since January.' Watch whether financial regulators make attack-IP sharing routine, and what the seven breached firms are found to have in common. When that question comes up before the National Assembly's National Policy Committee during the audit, that will be the real story.
Yonhap AKR20261006087751002 · Newsis NISX20261006_0003815422 · eToday · Financial News · Shinailbo · Economic Review · CBC News (all 10/6) · access counts attributed to each bank
The IP that breached the big banks also knocked on my online bank's door
Source: each firm checked its logs against the attack IP shared by financial regulators (Yonhap, Newsis, 10/6). "No damage" is each bank's own account. The same IP does not mean the same attacker.
The IP address used in the hacks of Shinhan, KB Kookmin, Hana and BNK Busan banks, two savings banks and Hyundai Capital also tried to reach the servers of KakaoBank, Kbank and Toss Bank, records show. All three say they detected and blocked the attempts and nothing leaked. The good news and the bad news sit in one sentence.
Unfold
Word of the day
Net sellingFinance
Selling more than you buy. Foreign net selling of 1 trillion won means foreigners as a group sold 1 trillion won more than they bought. What moves an index is who sold how much, net.