Bithumb confirms unauthorized access to internal mobile groupware system

Bithumb confirmed on Oct. 27 that an unauthorized outside party accessed its internal mobile groupware system (office collaboration software), resulting in a personal data leak. The exchange is investigating whether the intrusion compromised customer information and has not confirmed whether the outside party took customer records. Daishin Securities and Mirae Asset Global Investments also reported data breaches the same day. Bithumb is South Korea’s second-largest crypto exchange.

Yonhap, citing an industry source, said personal data belonging to Bithumb customers was exposed. Bithumb reported no stolen crypto assets and said the breach provided no access to customer crypto holdings.

Daishin Securities said hackers obtained personal and credit data on 38,490 customers. The leak covered names, e-mail addresses and mobile phone numbers. Daishin found unauthorized access to a server tied to online account openings on Oct. 17.

Mirae Asset Global Investments stated that it prevented unauthorized entry to certain online systems and found no investor data exposure. The firm reported a hacking incident but did not say how many clients the incident affected.

South Korea’s Financial Supervisory Service launched fresh inspections into breaches at Bithumb and Daishin Securities and is investigating all three cases. Authorities have not reported evidence of a common source for the attacks, and investigators have not linked the Bithumb intrusion to the other incidents.

FSS Director Lee Chan-jin urged firms to strengthen computer security at an Oct. 28 meeting and said attackers could use artificial intelligence to discover weaknesses. Lee said boards must take the lead in improving their companies’ security capabilities. He warned, “As artificial intelligence is used as a means of hacking, security vulnerabilities will be easily detected and simultaneous attacks will become a regular occurrence.”

The exchange has not disclosed the method used to access its system. Investigators have not publicly identified the attacker. Bithumb has not released the number of affected people, the specific employee records exposed, or whether the intrusion disrupted trading. The exchange has not set a completion date for its review, and its findings will determine whether the breach included customer data.

Coinfomania reported that Bithumb’s breach affected 38,490 customer accounts, a figure other sources attribute to Daishin Securities.

In February, Bithumb mistakenly credited users with 620,000 Bitcoin instead of planned cash rewards. One report put the mistake at 695 users and about $43 billion in Bitcoin, with 99.7% recovered. Another cited 249 users and 618,212 BTC recovered, and Bithumb promised full compensation plus 10%.

The Financial Services Commission said earlier this month that hacking attacks on 16 South Korean financial firms caused around 100,000 data leaks. Upbit suffered a Solana hot wallet hack (an internet-connected cryptocurrency wallet) in November 2025 that drained about $36 million. Local authorities suspected North Korea’s Lazarus Group. Blockchain researchers recently followed $19 million in transfers from wallets tied to a previous Bitget breach.

CoinDCX in India reported a $16 million loss tied to an older wallet system and said customer balances stayed safe. Bithumb has signed an agreement to expand into the Vietnamese market. Seoul’s crypto tax faces a fourth delay as the country struggles to settle its broader crypto rulebook. The breaches were reported the same day Coinbase said an analytics vendor incident exposed some customers’ contact data.

Changpeng Zhao listed four incidents in a tweet, warning that leaked exchange data is mainly used for phishing, SIM swapping and social engineering. South Korea’s Science Ministry and the Korea Internet & Security Agency urged website operators to check for PHP flaws that let attackers run commands without logging in.

Daishin said it would compensate customers for resulting damage under the law. Bithumb reported the breach to the Korea Internet & Security Agency and separately to the Personal Information Protection Commission.