Bithumb Breach Adds to South Korea Cybersecurity Concerns
Bithumb has confirmed that an unauthorized external party accessed its internal mobile groupware system and leaked personal information, adding the crypto exchange to a series of cybersecurity incidents reported by South Korean financial companies on Wednesday.
The scope of the Bithumb incident remains unsettled. Reuters reported that the exchange was investigating whether its member data was included, while other reports said the company had not yet established how many users, if any, were affected.
What happened
Bitcoin.com News reported that Bithumb, South Korea’s second-largest crypto exchange, confirmed that an outside party had entered its internal mobile groupware system. Firstpost, citing Yonhap News Agency, described the affected platform as an internal mobile system and said some customer information had leaked.
Crypto.news reported that the system was used by employees for workplace communications. It said Bithumb discovered the incident on October 27 and reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission the same day.
Authorities were also assessing breaches reported by Mirae Asset Global Investments and Daishin Securities. SBS News said the Financial Supervisory Service had identified hacking breaches at Bithumb, Mirae Asset Global Investments and Daishin Securities across the cryptocurrency and financial investment sectors.
Daishin has disclosed the most specific confirmed exposure among the three firms. Korea Herald reported that personal information belonging to 38,490 customers was hacked after the brokerage detected signs of unauthorized access last week. Reuters described the figure as about 38,000 pieces of customer information and said Daishin had taken emergency measures.
According to Korea Herald, the information found to have leaked at Daishin included names, e-mail addresses and mobile phone numbers. Crypto.news reported that hackers targeted a server connected to the firm’s remote brokerage account opening service, and that Daishin detected suspicious activity on October 17 before blocking IP addresses used by the attackers and reporting the matter to financial regulators.
Mirae Asset Global Investments also confirmed a hacking incident, Reuters reported, although the available disclosures did not establish the extent of any data exposure at the asset manager.
Why it matters
The Bithumb disclosure is significant because the exchange is still examining whether registered members’ information was involved. Reuters and Firstpost both reported that this question remained under investigation, leaving the scale and nature of potential exposure unresolved.
An intrusion into an internal employee communications system does not by itself establish that trading systems, account balances or member records were accessed. Still, the distinction between an internal system breach and a member-data breach is central for Bithumb users, regulators and the company because the investigation has not yet resolved whether customer information was included.
The incidents also place crypto platforms within a broader financial-sector cybersecurity issue rather than treating the Bithumb case as an isolated exchange event. Reuters reported that the three disclosures followed hacking attacks at 16 South Korean financial firms, including banks, which had resulted in around 100,000 cases of data leaks so far, according to the Financial Services Commission earlier this month.
Daishin’s disclosure illustrates why the content of exposed data matters as much as the number of affected customers. Korea Herald’s account identified contact information among the leaked fields, while Shattered reported that the breach included names, email addresses, mobile phone numbers, home addresses and bank account numbers. The reports available for Bithumb have not specified comparable categories of information.
Background and context
Bithumb is South Korea’s second-largest crypto exchange and has almost 10 million registered users. Its scale means that a breach involving internal systems draws attention not only to direct account security, but also to the potential secondary misuse of personal data if customer information is found to have been affected.
The incident emerged amid near-simultaneous intrusions reported at other financial firms. The Financial Services Commission, Financial Supervisory Service and Financial Security Institute have begun on-site checks and are pushing to apply bank-level security requirements to crypto firms.
Regulatory attention has focused on the wider pattern because Bithumb operates in the cryptocurrency sector while Daishin Securities and Mirae Asset Global Investments operate in the financial investment sector. SBS News reported that financial authorities were assessing the situation across all three cases.
The identities of the other affected firms have been reported inconsistently in some coverage. However, Reuters, SBS News, Firstpost and Korea Herald identified Daishin Securities and Mirae Asset Global Investments alongside Bithumb. The core unresolved point for the exchange is separate: whether Bithumb member data was exposed has not been confirmed.
What to watch
The first question is whether Bithumb’s investigation determines that registered member information was included in the leaked data. Reuters reported that the exchange was still examining that issue, and Firstpost said the lack of clarity left open how many users could be affected.
Further disclosures may also clarify what information was exposed, which systems were accessed and whether the incident was confined to the internal mobile groupware environment. No available report established that Bithumb’s trading infrastructure or customer accounts had been compromised.
For the wider financial sector, the status of the authorities’ assessment and on-site checks will be important. The reported incidents span an exchange, a brokerage and an asset manager, while the Financial Services Commission has already cited a broader wave of financial-firm hacking attacks earlier this month.
