South Korean cryptocurrency exchange Bithumb discovered unauthorized access to its internal mobile groupware on October 27 and reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) the same day, Yonhap reported.

What the Attackers Reached

The compromised tool is Daou Office, a workplace application Bithumb employees use for messaging and file sharing, News1 reported. Bithumb told the outlet that its trading services operate on a physically separate network and that no cryptocurrency was stolen. That is consistent with the controls described in Bithumb's October 2 security notice: cold-wallet storage and approval steps for moving customer assets, along with limits and access logging for staff who handle personal information.

The open question is what data sat inside the app. According to Digital Today, the information exposed so far relates mainly to employees, but Bithumb has not ruled out member data. Staff chats and shared files can pick up customer details during routine support work, which is why the review covers messages and documents rather than only the main customer database.

In a statement quoted by Financial News and translated from Korean, the exchange said: "We are analyzing the exact scope, including the possibility that member information was included."

Bithumb has not said how many people, if any, are affected, which data fields were exposed, or how the attackers gained access.

The 38,490 Figure Is Not Bithumb's

Bithumb disclosed its breach on the same day as two other Korean financial firms, and at least one crypto news site has since reported that Bithumb's breach affected 38,490 customers. That number belongs to Daishin Securities. The Korea Times reported that Daishin confirmed a leak of personal and credit information for 38,490 customers after unauthorized access to a server linked to online account openings, while Mirae Asset Global Investments was also hit.

Daishin's disclosure shows what a confirmed notice looks like. Digital Today reported that its review found eight types of leaked data, including names, email and home addresses, phone numbers, bank names and account numbers. Bithumb has not yet published anything comparable. There is also no public finding that the three incidents share an attacker or an entry point.

Bithumb Has Been Here Before

In 2017, an attacker compromised a Bithumb employee's home computer and obtained the names, email addresses and mobile numbers of about 31,800 users, according to reports at the time. No passwords were taken, and Bithumb stressed at the time that its head-office servers had not been breached.

The damage came afterwards. Customers began receiving calls and messages from people posing as Bithumb staff who already knew their names and numbers, and some were talked into sharing the one-time passwords that protected their accounts. More than 100 customers filed complaints with the police cybercrime unit, and Bithumb offered 100,000 won to every affected user plus reimbursement of proven losses.

The 2026 incident involves a different system and, so far, a different scope. But the pattern is the one to watch: the risk from a data leak at an exchange usually arrives later, through a phone call that sounds real because the caller knows real details. Similar concerns followed a customer-data breach at Israeli broker Bits of Gold.

The Warning Bithumb Issued Two Weeks Earlier

On October 14, before this incident, Bithumb published guidance on scams that use leaked personal information. It warned that a name, contact details and knowledge of the services someone uses can make a fraudulent message look legitimate, and described approaches built around fake compensation offers, identity checks and account-security reviews — exactly the lines a scammer would try on worried customers this week.

What Bithumb Customers Can Do Now

• Treat any call, text or email about the breach as unverified until it is checked in the Bithumb app or website normally used.
• Never share a password, one-time code or verification number with anyone who makes contact, whatever details they already know.
• Ignore "compensation" offers that ask you to log in through a link or move funds.
• Watch Bithumb's official notice board for a notification that names the data involved.

When Customers Should Hear More

Korea's Personal Information Protection Act sets a deadline. Once a company becomes aware that personal information has been leaked, it must notify affected individuals within 72 hours, including steps they can take to limit harm, and report to the PIPC or KISA within the same window if 1,000 or more people are affected or the leak involved illegal outside access.

Bithumb has already reported the intrusion to both agencies. If its review confirms that customer data was exposed, the 72-hour clock for notifying those customers starts from that finding. A useful notice would say which data fields were in the app, which period the exposure covers, and how Bithumb will contact affected users — so customers can tell a genuine message from the scams its own guidance warned about.

This article is provided for informational purposes only. The scope of the incident remains under investigation, and findings may change as Bithumb and the authorities release further information.