Bithumb, South Korea’s second-largest crypto exchange by trading volume, has disclosed a personal data leak after an outsider got into the internal mobile system its employees use for work. The exchange found the intrusion on Tuesday 27 October 2026 and reported it the same day to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC), Bithumb told Yonhap, as reported by CoinDesk and Cointelegraph on Wednesday 28 October.
Staff details are the first confirmed loss. Employees’ names, e-mail addresses and phone numbers leaked, iNews24 reported at 10:05 Korean time. Whether customer records went with them is still being checked, and Bithumb has given no head count.
The exchange insists that coins were never in play. It says the breached system sits apart from its trading platform and that “customer virtual assets cannot be accessed through this breach”, according to CoinDesk, which found no reported crypto losses as of the Asian afternoon.
By midday the Financial Supervisory Service (FSS) had sent on-site inspection teams to Bithumb and to Daishin Securities, Money Today Broadcasting (MTN) reported. For Bithumb it is the second internal-control problem of 2026, after a payout error in February that credited customers with bitcoin instead of won.
Bithumb data breach: what the exchange says is safe
The system in question is mobile groupware: an in-house app that staff use to message each other and pass work files around. Cointelegraph describes it as a tool “used by employees for work and information sharing”. The business news site Dealsite reports that the groupware is outsourced to Dau Technology. It is not the exchange, the wallets or the order book.
A Bithumb official told Dealsite that the groupware and the systems for trading and customer assets “are physically separated on different networks”. On scope, the company was more careful. “We are analyzing the exact scope, including the possibility of member information being involved,” it told Yonhap.
That caveat has a concrete reason. Staff blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap files over the groupware’s messenger, and Insight Korea reported that Bithumb is checking whether any of those files held member data. So the leak cannot yet be described as staff-only.
Bithumb told several Korean outlets it would put out an official notice on the morning of 28 October. Coindaro could not open the exchange’s notice board, and none of the Korean reports read for this article quotes such a notice. The official who spoke to Dealsite said details would follow once the investigation is largely complete.
Still unknown on 28 October
No count of affected people, staff or members, has been given, nor a full list of data fields. How the outsider got in, and who it is, has not been disclosed. CoinDesk noted that the exchange has not said whether deposits and withdrawals were affected. Neither KISA nor the PIPC has commented on the case, and no fine has been announced.
No source links the Bithumb intrusion to any named group or tool. The figure of 38,490 seen in coverage the same day belongs to Daishin Securities, not to Bithumb.
Three firms under FSS review on the same day
The FSS was assessing three firms on 28 October: Bithumb, Daishin Securities and Mirae Asset Global Investments, according to CoinDesk. Daishin said personal and credit information of 38,490 customers leaked in an outside attack; MTN listed eight fields, from names and addresses to account numbers, some of them encrypted. Mirae Asset said it blocked abnormal external access to some web systems and that investor information was not affected.
MTN reported that the inspections at Daishin and Bithumb will be turned into formal examinations if violations are found. FSS Governor Lee Chan-jin raised the attacks that morning at a regular meeting with the board chairs of eight bank holding companies. “I understand that major financial investment companies experienced overall hacking incidents yesterday,” he said, as quoted by CoinDesk. Both crypto outlets also cite his earlier count: attacks had hit 16 South Korean financial firms as of 14 October.
That count matches a statement by the Financial Services Commission reported by Reuters on 14 October: hacking incidents at 16 financial firms and around 100,000 data-leak cases. The authorities were checking whether artificial intelligence was involved, and planned security inspections and early-warning measures.
A wave that began at Korean banks in September
The October count grew out of intrusions at the end of September. Between 27 and 30 September, attackers got into systems at Shinhan Bank, KB Kookmin, Hana, Welcome Savings Bank, BNK Busan, Yegaram Savings, Hyundai Capital and two online peer-to-peer lenders, Kyunghyang Shinmun reported on 4 October. Shinhan lost 25,727 records, including names, contacts, annual income and loan limits, through a loan-progress service used by brokers.
One detail stands out next to Bithumb’s case. At KB Kookmin, the 119 affected customers were exposed through an internal mobile work-support system for employees, the same kind of tool Bithumb says was breached. That is a similarity of target, not evidence of a common attacker.
According to Kyunghyang, the attackers used AI-driven brute-force attempts against weaker systems, with ARTEX, an open-source penetration-testing tool built on a large language model and released on GitHub on 26 July. The newspaper said the authorities saw random automated hits rather than a targeted strike, with IP addresses from eight countries, and that President Lee Jae Myung called for a thorough investigation. Whether Bithumb was hit with the same tool is not known, and no source has said so.
| Firm | When | What was reported | Reported by |
|---|---|---|---|
| Shinhan Bank | 27-30 Sept 2026 | 25,727 records (names, contacts, income, loan limits) | Kyunghyang Shinmun |
| Welcome Savings Bank | 27-30 Sept 2026 | More than 2,200 corporate records | Kyunghyang Shinmun |
| KB Kookmin Bank | 27-30 Sept 2026 | 119 customers, through an employee mobile work-support system | Kyunghyang Shinmun |
| Hana Bank | 27-30 Sept 2026 | 89 customers | Kyunghyang Shinmun |
| 16 financial firms in total | As of 14 Oct 2026 | About 100,000 data-leak cases | Reuters |
| Daishin Securities | Late October 2026 | Personal and credit data of 38,490 customers | CoinDesk, Cointelegraph, MTN |
| Mirae Asset Global Investments | Late October 2026 | Abnormal access to some web systems blocked; investor data not affected, it says | CoinDesk, Cointelegraph |
| Bithumb | Detected 27 Oct 2026 | Staff names, e-mail addresses and phone numbers leaked from an employee system; member data still being checked | Yonhap via CoinDesk; iNews24 |
The 26 October arrest is a separate case
On 26 October, Seoul police announced that a 32-year-old man had been referred to prosecutors, with six others under investigation, the Seoul Economic Daily reported. Police say the group hit more than 90 businesses over about 13 months and took 8.2 million records. Victims included academies, hospitals, golf courses, universities, a funeral services provider and a regional mutual finance institution. The police said the autonomous AI penetration-testing system used was the same tool as in a recent financial-sector breach, but that no connection between the two cases had been confirmed. Nothing ties that case to Bithumb.
In Japan the same week, GMO Internet reported its own intrusion, through logins saved on rented trading servers; our report on the GMO cyberattack and what GMO Coin said about trades covers it. There is no known link with the Korean attacks.
Bithumb’s record: a 2017 leak, two thefts and a payout error
This is not the first customer data leak at Bithumb. In 2017 an attacker sent a spear-phishing e-mail with a malware-laden CV to an outside consultant on 28 April and took files from that person’s personal computer, including a member spreadsheet. The Korea Communications Commission counted 36,487 leaked records (31,506 user records and 4,981 website accounts) and in December 2017 imposed a 43.5 million won fine plus a 15 million won administrative penalty, Newsis reported. Among its findings: the file had been kept unencrypted on a personal PC.
The coins have been hit too. Nearly 35 billion won ($31.6 million) was stolen in an attack that ran from the night of 19 June 2018 into the next morning, The Next Web reported. Bithumb halted deposits and withdrawals and promised to compensate users from its own funds if the coins were not recovered. In March 2019 about 3 million EOS and 20 million XRP, close to $19 million in all, were taken; Bithumb spotted the abnormal withdrawal on the night of 29 March and called it an accident involving insiders, Security Affairs reported.
February 2026 was a different kind of failure. Bithumb acknowledged that it had credited customers with 620,000 BTC instead of 620,000 won in a promotion, worth more than $40 billion at the time, according to CoinDesk. It was an input error, not an attack, and the FSS opened an inquiry. Chief executive Lee Jae-won said the exchange was “acutely aware of the deficiency in internal system control”.
Seoul has other business with the exchange: it was one of the five platforms called in when the government discussed a fourth delay to Korea’s 22% crypto tax.
After a data leak, the risk is phishing
A leak that touches no coins still gives criminals something to work with. The 2017 file shows the pattern. Reviewing logs from April to June that year, the regulator found about 2 million password-guessing attempts from 3,434 IP addresses; 4,981 accounts were broken into, and 266 of them showed crypto withdrawals after login.
A Bithumb notice cited by Insight Korea warns that a caller who knows your real name and number is not proven genuine by that alone. It asks users to check any request to click a link, install an app or move funds, framed as compensation or a security check, through the official app or website. Until the exchange says which data was involved, account holders can assume their name, phone number and e-mail address may be known to strangers.
- Treat any message about the leak, a refund or “account verification” as suspect, even if it uses your real name. Open the app or type the address yourself instead of tapping a link.
- Never give a password, a one-time code or a recovery phrase to anyone who calls or writes, whatever authority they claim.
- Use a password for the exchange that you use nowhere else, and switch on app-based two-factor authentication.
- Check the withdrawal address whitelist and login history in your account settings, and remove anything you do not recognise.
Phishing mail that quotes real customer details has followed several leaks this month, for example after the Keystone web-shop breach. Our guide on how to avoid crypto scams lists the usual red flags and where to report them. Readers outside Korea with no Bithumb account are not directly affected.
What to watch next
Bithumb’s own figures come first: how many people, which fields, and whether members are among them. Then the FSS inspections, which could become formal examinations, and any word from the PIPC or KISA.
Trading has not been reported as disrupted, and no market move is tied to the story. The question the exchange has not answered is whether a staff messaging app held member data at all.