Bithumb Says Hackers Accessed Internal System, Leaking Personal Data
Key Takeaways
- •An unauthorized party accessed Bithumb's internal mobile groupware system, and the exchange is still investigating whether customer data was among the leaked information.
- •Daishin Securities reported that the personal data of 38,490 customers, including names, email addresses and mobile phone numbers, was leaked, and it pledged to compensate customers for any resulting damage under the law.
- •Mirae Asset Global Investments confirmed a hacking incident, and South Korean financial authorities have launched inspections into the reported breaches.
- •Binance founder Changpeng Zhao warned that leaked exchange data is mostly exploited for phishing, SIM swapping and social engineering, urging users to use unique email aliases, avoid SMS-based two-factor authentication and request number locks from carriers.
- •The breach adds to a turbulent 2026 for Bithumb, which earlier mistakenly credited users with 620,000 BTC in February, was fined 36.8 billion won over anti-money-laundering failures in March, and saw its CEO booked as a bribery suspect in June.
South Korean crypto exchange Bithumb said an outside party accessed its internal mobile groupware system and leaked personal information. The exchange is investigating whether customer data was among the information exposed, though an industry source told Yonhap that some personal information belonging to Bithumb customers had been leaked. Brokerage Daishin Securities and asset manager Mirae Asset Global Investments also reported data breaches, and financial authorities have begun inspecting the incidents.
Bithumb, South Korea's second-largest crypto exchange, said an unauthorized outside party had accessed its internal mobile groupware system — the workplace collaboration software companies use for internal messaging, scheduling and document sharing — resulting in a leak of personal information, according to Yonhap News Agency. The exchange is investigating whether customer data was compromised, Reuters reported, citing Yonhap.
Bithumb was one of three South Korean financial firms to report data breaches on Wednesday, local time. Brokerage Daishin Securities said the personal information of 38,490 customers, including names, email addresses and mobile phone numbers, was leaked after it detected signs of unauthorized access last week. The firm said it would compensate customers for any resulting damage in accordance with the law.
Asset manager Mirae Asset Global Investments also confirmed a hacking incident, and financial authorities have begun an inspection. Spokespeople for the three firms could not be immediately reached for comment by Reuters. Whether Bithumb's investigation confirms that customer data was exposed, and what the financial authorities' inspections turn up, are the key open questions in the case.
The breaches follow a wave of hacking attacks on 16 South Korean financial firms, including banks, that had caused around 100,000 data leaks, the Financial Services Commission, South Korea's top financial regulator, said earlier this month, according to Reuters.
The Korean breaches were reported the same day Coinbase said a security incident at analytics vendor Amplitude had exposed some of its customers' contact data, though customer funds were not affected. Binance founder Changpeng "CZ" Zhao listed all four incidents in a tweet on Wednesday, warning that leaked exchange data "is mostly used for phishing, SIM swapping, and social engineering." All three techniques exploit personal data rather than direct attacks on exchange infrastructure.
4 data leaks reported today:
- Coinbase's vendor Amplitude exposed some users' contact data (funds unaffected).
- Bithumb (Korea) had user data leaks.
In TradFi, two securities firms in Korea leaked data:
- Mirae Asset
- Daishin Securities
You can't prevent a leak, but…
— CZ 🔶 BNB (@cz_binance) October 28, 2026
"You can't prevent a leak, but you can protect yourself," Zhao wrote, urging users to sign up to each exchange with a unique email alias, avoid text message-based two-factor authentication and ask their phone carrier for a number lock. Text-message codes are a common target of SIM swapping, in which attackers hijack a victim's phone number to intercept calls and verification messages. Leaked addresses and holdings data "have led to real-world extortion and robberies," he added.
Separately, South Korea's Science Ministry and the Korea Internet & Security Agency have urged website operators to check for recently disclosed flaws in PHP, the programming language behind much of the web, which let attackers run commands on a server without logging in. Bithumb has not said how its system was accessed.
Bithumb's turbulent year
The breach is the latest setback for Bithumb in 2026. In February, the exchange mistakenly credited 695 users with a total of 620,000 BTC, worth about $43 billion at the time, during a promotion meant to hand out small cash rewards. The deposits existed only on Bithumb's internal ledger, and the exchange said it recovered 99.7% of the Bitcoin.
In March, South Korea's Financial Intelligence Unit fined Bithumb 36.8 billion won ($24.6 million) and ordered a six-month partial suspension over anti-money laundering failures, but a Seoul court blocked the suspension in April.
Bithumb has since set out a three-stage plan to list on the stock market in 2028, while its CEO, Lee Jae-won, was booked as a bribery suspect in June over the alleged hiring of a National Assembly member's son.
