Bithumb investigates data leak after breach of internal mobile system

What happened

Bithumb is investigating a data leak that followed unauthorized access to an internal mobile system used by its employees, according to reports from Cointelegraph and Coinpedia. Cointelegraph, citing Yonhap News Agency, reported that the South Korean crypto exchange found the breach on Tuesday and notified the Korea Internet & Security Agency and the Personal Information Protection Commission that same day.

The exchange is trying to establish how far the incident reached, including whether information about its members was involved. Bithumb told Yonhap it was analyzing the exact scope and planned to issue an official announcement. It also said its internal work system is kept apart from its virtual asset trading system, so the breach does not provide a route to customer virtual assets, according to Cointelegraph.

Coinpedia reported that Bithumb confirmed unauthorized access to its employee mobile groupware system, which is operated through the third-party platform Daou Office. Employee details exposed in the incident included names, work email addresses and mobile phone numbers, Coinpedia said. The exchange was still reviewing system records to determine whether customer information was also exposed.

Cointelegraph said it contacted Bithumb for further comment. The reports did not disclose how many employees or customers might be affected.

Why it matters

The incident puts attention on the security of internal tools used by crypto exchanges, not just public-facing trading platforms. Bithumb's statement that trading systems were separate is important because it limits the immediate concern to data protection rather than custody of customer assets.

Even so, any exposure of employee or customer information can create privacy and operational risks, and the exchange has not yet completed its assessment. The breach also adds to a wider pattern of cyber incidents at South Korean financial companies, which regulators have been discussing publicly.

What the data shows

Bithumb has not disclosed a number of affected users or employees. The details confirmed so far concern employee names, work email addresses and mobile numbers, while the question of member data remains under review. The wider figures reported this week include 38,490 Daishin customers, more than 60,000 harmful requests detected by Daishin over 10 days, 16 financial firms cited by the FSS governor, and around 100,000 data leak cases mentioned by the governor. Coinpedia also cited SlowMist's estimate of about 70,000 potentially affected Coinbase users, a figure Coinbase has not confirmed.

Background

South Korea's financial sector has seen a series of cyberattacks. Cointelegraph reported that Financial Supervisory Service Governor Lee Chan-jin said at a meeting on Wednesday that 16 South Korean financial firms had been hit by cyberattacks as of Oct. 14. Coinpedia reported that Lee said at least 16 financial firms faced attacks in October, leading to around 100,000 cases of data leaks.

Among the other incidents, Daishin Securities said personal and credit information belonging to 38,490 customers had leaked, according to both reports. Coinpedia said the brokerage detected suspicious activity on Oct. 17 and later found more than 60,000 harmful requests over 10 days, with leaked data including names, email addresses, home addresses and account details, some of it encrypted. Mirae Asset Global Investments, which Coinpedia said manages $461 billion in assets, blocked abnormal external access to some web systems and said investor information was not affected, according to Yonhap.

Separately, Coinbase denied an internal system breach after an incident at analytics provider Amplitude exposed a subset of customer contact data, Coinpedia reported. SlowMist estimated that about 70,000 Coinbase users may have been affected, but Coinbase did not confirm that figure and said it found no evidence of unauthorized access to its systems, with customer funds unaffected.

What is still unclear

Several points remain unresolved. Bithumb has not said whether customer data was accessed or how many people were affected, and the final scope of its review is still pending. The reports also do not describe how the intruders entered the internal mobile system or whether the third-party platform Daou Office was itself compromised. The relationship between the Bithumb incident and the other attacks reported in South Korea in October has not been established.

What to watch

Bithumb's promised official announcement will be the next key update, particularly on whether member information was involved. Also worth watching are any findings from the Korea Internet & Security Agency and the Personal Information Protection Commission, and whether South Korean financial regulators disclose further details about the broader wave of attacks. For now, the exchange maintains that its trading system is separate from the affected internal work system.

Questions readers ask