Bithumb Hacked Months After Its $40B Bitcoin Blunder

• Bithumb confirmed that an outside party accessed an internal mobile system used by its employees.
• No cryptocurrency losses have been reported, while checks on customer data continue.
• The breach is part of a wider wave of attacks on South Korean financial firms.
• The FSC wants crypto businesses held to security standards closer to those of major banks.

Bithumb, one of South Korea’s two largest cryptocurrency exchanges, confirmed on October 28 that an unauthorized outside party had broken into the mobile groupware its staff use for internal messaging and administrative work, exposing employee personal information. The exchange says its trading and custody systems run on separate infrastructure and that no crypto has been lost, although regulators are still checking whether customer data was reached. The disclosure comes eight months after Bithumb mistakenly credited users with roughly 620,000 BTC, and it lands in the middle of a hacking wave that has now touched at least 20 South Korean financial institutions.

What the Intruders Reached

Bithumb detected the intrusion on October 27 and reported it the following day to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC), the country’s privacy watchdog. According to the Financial Services Commission (FSC), the potentially exposed records belong to employees of Bithumb, its subsidiaries and its partner companies. A Bithumb spokesperson said investigators have found no exposure of wallet addresses or of any data that could be used to push through unauthorized transfers.

The exchange has not disclosed how many people are affected, how the attackers got in or who they might be.

Status as of October 28, per Bithumb and the FSC.

Why a Staff App Still Matters

Exchanges keep wallets and matching engines on isolated networks so that a break-in at the office layer cannot reach customer funds, and on the evidence so far that separation held. Employee records carry a different kind of risk. Names, phone numbers and internal roles give an attacker what is needed to impersonate staff, aim phishing at colleagues who hold privileged access, or call customers while posing as support. None of that has been reported in this case.

Bithumb knows the pattern from experience. In 2017, a compromised employee home computer leaked the details of about 3% of its customers, and fraudsters then phoned victims pretending to be Bithumb staff to obtain one-time passwords and empty their accounts.

The groupware itself raises a second question. The system is supplied by an outside vendor, and South Korean media reported that other companies using the same product could face similar exposure if a software flaw was the entry point. Investigators have not established that.

Twenty Institutions and Counting

Bithumb was one of three financial companies that disclosed incidents on October 28.

Attackers at Daishin went through a server linked to online account opening, and the brokerage sifted through more than 60,000 suspicious signals disguised as normal service requests after spotting unauthorized activity on October 17. Slow detection is a recurring problem across the sector. Shinhan Bank needed about 15 and a half hours to identify an attack that began on September 28, while KB Kookmin Bank first reported 119 affected people and later raised the figure to 2,210.

On October 21, financial authorities warned institutions about roughly 4.4 million scanning attempts from IP ranges allocated to North Korea. Scanning means probing for weak spots, which is different from a successful breach, and officials say they have found no verified link between those addresses and Bithumb. They have also pointed out that third parties could be routing traffic through compromised North Korean infrastructure. The National Police Agency has opened an inquiry covering the recent incidents. Lee Chan-jin, governor of the Financial Supervisory Service (FSS), warned on October 28 that AI tools make security gaps easier to find and coordinated attacks more frequent, although no technical report has described how Bithumb was breached.

The February Blunder Still Shadows Bithumb

In February, an employee setting up promotional rewards selected bitcoin instead of Korean won as the payout unit, and Bithumb’s internal ledger showed balances worth more than $40 billion that the exchange never held. It restricted 695 accounts and reversed 99.7% of the credits before they could be traded. Some recipients still sold in time, briefly pushing the local bitcoin price about 18% lower. The FSC later said it found deficiencies in Bithumb’s internal controls. In August, the Seoul Central District Court ruled for the exchange in suits to claw back proceeds, with one order covering about 194 million won (around $135,000).

The two incidents have different causes and no known technical link. Both, though, trace back to how a large exchange governs what its own staff and staff tools can do.

Bank-Grade Rules on the Table

The FSC, the FSS and the Financial Security Institute launched on-site investigations at Bithumb, and authorities say they will oversee customer protection, including full compensation if losses emerge. The bigger signal is regulatory. The FSC plans tougher cybersecurity duties for crypto businesses and other firms outside the Electronic Financial Transactions Act, the law that sets IT security and incident-response obligations for banks and payment companies. Exchanges currently answer mainly to the Virtual Asset User Protection Act, in force since July 2024, which focuses on safeguarding customer deposits and policing unfair trading rather than on how an exchange defends its corporate IT.

Closing that gap would likely mean stricter oversight of outside software vendors, faster mandatory incident reporting and heavier spending on intrusion detection. The FSC has described these as plans, and no new requirement is in force yet.

The breach also lands on a crowded regulatory file. Bithumb is still contesting a 36.8 billion won (about $25 million) fine and a six-month partial business suspension that the Financial Intelligence Unit imposed over customer identity checks, with a court stay granted on May 1 keeping the exchange fully operational, and the FSC has yet to announce sanctions over the February payout. Whether investigators find customer records in the stolen data, and whether other users of the same groupware come forward, will shape how much weight this incident carries in those proceedings.