Key Insights
- Employee Data Leak—Bithumb confirmed that the employee information was leaked.
- Customer Data Uncertain—Investigators are checking possible customer exposure.
- Wider Cybersecurity Risks—South Korean financial firms face growing cyberattacks.
On October 28, South Korea’s No. 2 cryptocurrency exchange by trading volume Bithumb, announced it had suffered an internal data hack, and that employee data was stolen. Having sparked cybersecurity worries throughout the financial sector in the country, several firms have reported cyberattacks in the past few days. Investigators now believe the data was also compromised for customer information.
🚨SOUTH KOREA’S SECOND-LARGEST EXCHANGE BITHUMB CONFIRMS INTERNAL SYSTEM HACK AND PERSONAL DATA LEAK!
Bithumb detected unauthorized access to its internal mobile groupware system, leading to a personal information leak. It is checking whether any member data was involved.
The… pic.twitter.com/mmmhSrqV4N
— Crypto Banter (@crypto_banter) October 28, 2026
Internal system breach raises data exposure concerns
Bithumb detected abnormal access to its internal mobile groupware system on October 27. The platform supports employee communications and work scheduling, operating separately from the exchange’s cryptocurrency trading infrastructure.
The company notified the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission after identifying the incident. According to reports from Yonhap News Agency, Bithumb began assessing the extent of the intrusion and the information potentially affected.
The exchange subsequently confirmed that an unauthorized external party had accessed its internal groupware system and leaked personal information. However, investigators had not established the total number of affected individuals.
The exposed information reportedly includes employee names, email addresses and telephone numbers. Bithumb employs approximately 650 people, although the company has not confirmed how many employees suffered data exposure.
A company representative said the investigation would determine whether customer information also appeared among the compromised records. Bithumb has maintained that the internal work system remains separate from its virtual-asset trading platform.
Consequently, the company said the breach did not provide direct access to customers’ cryptocurrency holdings through the compromised system. However, the investigation must establish whether other customer information was exposed.
Financial firms report additional security incidents
The Bithumb incident emerged amid a wider series of cybersecurity breaches affecting South Korean financial institutions. Authorities have been examining attacks involving securities firms, investment managers and cryptocurrency businesses.
Daishin Securities confirmed that hackers obtained personal and credit information belonging to 38,490 customers. The company traced the incident to unauthorized access involving a server connected to its non-face-to-face discretionary investment account service.
The leaked records reportedly contained eight categories of information, including names, email addresses, residential addresses, telecommunications identifiers, bank details and account information. Some account numbers and telephone numbers had encryption protections.
Meanwhile, Mirae Asset Global Investments reported abnormal external access to certain web systems. The company said it blocked the suspicious access and found no evidence that investor information had been affected.
Mirae Asset Life Insurance reported an information leak on October 26. Earlier reports also identified security incidents involving Streami, the operator of the Gopax cryptocurrency exchange and other financial-sector businesses.
These incidents have broadened scrutiny, beyond financial platforms. Attackers can also target employee communication tools, accessible servers and systems managed by outside vendors.
Regulators strengthen cybersecurity oversight
South Korean financial officials are worried about how how big the attacks have been lately. The head of the Financial Supervisory Service, Lee Chan-jin said that cyberattacks have impacted 16 companies by October 14.
At a meeting with leaders, from holding companies on October 28 Lee asked for better security practices and for companies to find technical weaknesses on their own. He also said that artificial intelligence might be used by people to find weak spots and plan attacks at the same time.
Separately, the Ministry of Science and ICT launched security inspections covering approximately 172 facilities operated by 111 institutions. Telecommunications infrastructure and Internet data centers are also reviewed, but a special focus is on systems that are accessible from external networks.
Authorities will be gathering inspection reports and self-assessments prior to on-site inspections. The process may assist investigators in the detection of vulnerabilities exploited by attackers in systems that are interconnected.
The incidents also show how important it is to keep an eye on third‑party software and on service providers. A compromised partner system can bring security risks even if a company keeps its financial platform separate, from its internal operations.
Customer protection remains the central question
Bithumb’s immediate concern is whether investigators will find more information about exposure than what they have already collected for employees. If a customer data breach is confirmed, there is potential for adding risks to phishing, impersonation and targeted social engineering attacks.
But it has not been proven that hackers got into the customer’s cryptocurrency accounts or interfered with trading. Bithumb has emphasized the separation between its internal groupware and trading systems.
The exchange also faces renewed scrutiny over internal controls following a separate incident in February. At that time, it mistakenly credited customers with 620,000 bitcoin instead of 620,000 won. The error highlighted weaknesses in its internal processes, although it involved a different issue from the current cybersecurity breach.
Investigators will now have to assess the total scope of the intrusion in October and if customer records were accessed. Their results will shed light on the implications of the incident on Bithumb and the financial world.
