South Korea's financial authorities have launched on-site inspections of Bithumb, one of South Korea's major cryptocurrency exchanges, after the exchange reported indications that abnormal external access had exposed employee information, even as it continues to determine whether customer data was also compromised.

In an Oct. 28 notice, the Financial Services Commission (FSC) said the information involved in the incident concerns employees of Bithumb, its subsidiaries, and partner companies. At an emergency meeting, Bithumb said the affected system supports employees' work and is not part of the core computing facilities used for cryptocurrency trading.

According to the FSC, the exchange has not confirmed any leak of information that could be used for fraudulent payments or crypto transfers, including wallet addresses. That finding, however, leaves the broader assessment of possible customer-data exposure unfinished.

Regulators mobilize joint on-site response

The immediate response brings together the FSC, the Financial Supervisory Service, and the Financial Security Institute in an on-site investigation. The FSC said the agencies are sharing information and cooperating closely to identify the cause of the incident.

According to the notice, the emergency meeting was chaired by Yoo Young-joon, the FSC's digital finance policy head. Bithumb and DAXA, the Digital Asset Exchange Alliance that serves as the country's joint self-regulatory body for crypto exchanges, joined the supervisory and security bodies, presenting the exchange's report to the institutions coordinating the response. An Oct. 28 post by the FSC also described the emergency meeting and the start of the on-site inspections. The FSC's notice sets out both the agencies' actions and Bithumb's account of the affected staff-support system.

The regulator's response also includes a conditional compensation plan. Should consumers suffer damage, the FSC said it plans to oversee protection measures, including full compensation.

Bithumb identified the affected system in its report, while the regulators' on-site work aims to establish the cause of the breach. The staff-system disclosure and the continuing customer-data check leave the investigation with separate questions to resolve. The FSC has not announced a completed investigation or a final assessment of customer impact.

FSC targets a security gap beyond Bithumb

Alongside the inspections, the FSC outlined plans to strengthen security at virtual asset businesses and in other sectors it says currently fall outside the Electronic Financial Transactions Act, the statute that governs electronic payment and funds-transfer services at banks and other licensed financial institutions. South Korean virtual asset businesses currently register as virtual asset service providers under the country's financial-reporting and anti-money-laundering rules rather than under that law. The regulator wants their safeguards to match those of banks and other major financial institutions. The stated objective also includes readiness to respond quickly when an incident occurs, meaning the proposal concerns both the standards firms should meet and their capacity to react once a breach happens.

The Oct. 28 notice does not set out an enacted new requirement or an implementation deadline. While the proposed response names crypto businesses, the announcement leaves the specific measures and their timing to be established.

The FSC placed its Bithumb response alongside recently reported incidents at Mirae Asset's life-insurance and asset-management businesses, as well as additional customer-data exposure discovered during Daishin Securities' investigation. The notice extends the regulator's attention across several financial sectors without establishing that the incidents share a technical cause.

The backdrop is the broader South Korean financial-sector breach wave reported on Oct. 15, when the FSC named two other crypto firms. The new Bithumb disclosure adds an immediate inspection response and a specific plan to pursue bank-level security for sectors outside the electronic-finance law. Per the FSC, Bithumb has reported that it is still checking whether any customer data was leaked.