South Korean cryptocurrency exchange Bithumb has confirmed a cybersecurity breach that exposed sensitive personal information belonging to 844 customers and 715 employees after hackers gained unauthorized access to its internal communication system. The incident affected records associated with 6,444 customers, although information belonging to 5,600 customers remained protected by encryption. Exposed records included names, phone numbers, email addresses, government identification numbers, bank account details and copies of identification documents. Bithumb says its cryptocurrency trading platform and customer assets were not compromised, while South Korean regulators are investigating a broader wave of cyberattacks targeting financial institutions.
Hackers Breach Bithumb’s Internal Employee System
The attack occurred on October 27, when an unauthorized party accessed Daou Office, a third-party mobile workplace platform used by Bithumb employees to communicate and share business documents.
According to the exchange, the intrusion took place between approximately 11:28 a.m. and 12:27 p.m. Korean time.
Bithumb detected suspicious activity during the attack, blocked the unauthorized access and suspended use of the affected system.
The company subsequently notified the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC).
Initial reports suggested that only employee information had been compromised. However, further investigation revealed that customer records were also exposed through documents and communications stored in the internal system.
Bithumb Confirms 844 Customers Had Readable Personal Data Exposed
In an October 29 update, Bithumb disclosed that the incident involved information associated with 6,444 customers.
The exchange distinguished between records that were accessible to the attackers and files that remained encrypted.
| Affected group | Number |
|---|---|
| Customers whose readable personal data was exposed | 844 |
| Customers whose records remained encrypted | 5,600 |
| Employees whose personal data was compromised | 715 |
| Total individuals whose records were involved | 7,159 |
The exposed information varied between individuals but included sensitive identity and financial records.
Some affected customers had their resident registration numbers, driver’s license numbers, bank account numbers and identification document copies compromised.
These records are particularly sensitive because criminals could potentially use them for identity theft, impersonation or targeted phishing attempts.
Although the encrypted records were also involved in the breach, Bithumb says the attackers could not access their underlying contents.
Customer Cryptocurrency Funds Reportedly Remain Secure
Bithumb emphasized that its compromised employee communication platform operates separately from the infrastructure used to process cryptocurrency transactions.
The exchange said investigators found no evidence that hackers accessed its core trading systems, customer cryptocurrency holdings or primary customer database.
No cryptocurrency losses directly associated with the incident have been confirmed.
However, the absence of stolen digital assets does not eliminate the potential consequences of a personal information breach.
Attackers possessing identity documents, account numbers and contact information may attempt to impersonate customers or conduct convincing social engineering attacks.
Bithumb says it is contacting affected customers and reviewing potential secondary damage.
South Korean Financial Institutions Face Broader Hacking Wave
The Bithumb breach occurred alongside cybersecurity incidents involving several major South Korean financial institutions.
Daishin Securities reported that personal information belonging to 38,490 customers had been exposed through unauthorized access.
Mirae Asset Global Investments also confirmed suspicious activity involving its systems, although investigators initially reported no confirmed compromise of customer information.
The incidents prompted heightened scrutiny from South Korean financial regulators.
Earlier in October, authorities reported cybersecurity incidents involving 16 financial institutions, with approximately 100,000 personal information records affected.
The number of institutions reporting incidents has since increased.
However, investigators have not established that every attack was conducted by the same individuals or criminal organization.
Regulators Launch Emergency Security Review
South Korean authorities have initiated investigations into the incidents and are evaluating whether additional cybersecurity requirements are needed for cryptocurrency exchanges.
The Financial Services Commission (FSC), Financial Supervisory Service (FSS) and other agencies are examining how attackers accessed internal systems and whether existing security procedures were adequate.
Officials are also reviewing how sensitive customer information is stored and shared within financial institutions.
The incident raises questions about third-party software security because Bithumb’s breach involved an employee workplace application rather than the exchange’s core trading infrastructure.
Financial institutions increasingly depend on external software providers for communication, document management and operational services.
If those systems contain customer identification records, a security weakness can expose sensitive information even when transaction processing infrastructure remains protected.
Bithumb CEO Apologizes and Promises Security Improvements
Bithumb CEO Lee Jae-won apologized to customers following confirmation of the data exposure.
The company said it would review its internal security infrastructure and work with the affected software provider to address vulnerabilities.
Bithumb also pledged to provide appropriate assistance and compensation if customers experience confirmed secondary losses resulting from the breach.
Affected users are being notified individually and can check the exchange’s official website for information about their exposure.
Customers should remain alert for suspicious messages requesting passwords, authentication codes, identity verification or cryptocurrency transfers.
Crypto Exchanges Face Growing Data Protection Challenges
The incident demonstrates that cryptocurrency exchange security extends beyond protecting digital wallets and private keys.
Even when customer funds remain secure, personal information stored in employee systems can create significant risks.
Government identification documents and banking information can be especially valuable to cybercriminals attempting identity theft or account takeover schemes.
The breach also illustrates why cryptocurrency companies must evaluate the security of external vendors and internal workplace applications, not just blockchain infrastructure.
As exchanges become more integrated into traditional financial services, regulators are likely to place greater emphasis on protecting customer data across every part of their operations.
Bithumb Breach Highlights Risks Beyond Cryptocurrency Theft
Bithumb’s latest cybersecurity incident adds to growing concerns about attacks targeting South Korea’s financial industry.
Although the exchange reports that customer cryptocurrency assets remain unaffected, the exposure of sensitive identification and banking records creates potential risks for affected individuals.
The incident also raises broader questions about how financial institutions manage customer information within employee communication platforms and third-party applications.
