South Korea's National Police Agency has opened a preliminary investigation into fresh data breaches at cryptocurrency exchange Bithumb, Daishin Securities and Mirae Asset Global Investments, probing the scale of the stolen data and whether the incidents are connected to an earlier wave of AI-assisted attacks that hit 16 financial firms in the country (Yonhap).

The same team at the National Office that had been working on the previously reported bank hacks took over the investigation into the newest incidents as of Wednesday morning.

Which South Korean companies were hit?

Daishin Securities, Bithumb and Mirae Asset Global Investments are the latest firms caught in a wave of breaches concentrated in South Korea.

Per local reports, Daishin Securities was the hardest hit, with the personal and credit data of 38,490 customers exposed.

Bithumb has so far confirmed that attackers accessed staff data; the exchange is still assessing whether member information was also stolen. At Mirae Asset Global Investments, information from internal business systems was exposed, although the firm's statement reported no evidence that personal credit data had been taken.

Once fully confirmed, the numbers from the three new incidents will add to the roughly 100,000 records exposed at 16 financial companies as of October 14.

Are the South Korean hacks connected?

No link has been confirmed, but investigators from the National Police Agency are comparing the methods used in the recent breaches to identify matches and determine whether the attacks are isolated.

Local outlet Seoul Economic Daily quoted a police official as saying: “We are not ruling out the possibility that this was an attack by the same person behind the bank hacking case.”

If investigators confirm a connection, it would mean the same attackers who used ARTEX to hit the banks are behind the late-October breaches. ARTEX is a China-built, open-source agentic penetration-testing tool that runs alongside large language models such as Claude Code.

As Cryptopolitan previously reported, CrowdStrike found the attacker's own Claude Code session logs, ARTEX configuration files and memory files sitting in exposed server directories. Based on assessments of the recovered files, CrowdStrike identified a financially motivated, Chinese-speaking operator with moderate confidence. Because the attacker used the same tools to draft a résumé, they leaked their own contact and Telegram details, which CrowdStrike said may belong to a 26-year-old in Maoming, Guangdong — although the security firm conceded that these identifiers are not 100% reliable.

South Korean specialists are skeptical of attributing the attacks to Chinese involvement simply because the tool was built in China. A professor at Korea University's Graduate School of Information Security questioned whether ARTEX was the only tool used in the attacks.

Victim numbers continue to grow

Earlier this week, KB Kookmin Bank said a detailed re-examination lifted its confirmed victim count from 119 to 2,210 (Seoul Economic Daily). Mirae Asset Life Insurance, a separate entity, also detected intrusions and drew an urgent on-site inspection from the Financial Supervisory Service.

The Financial Services Commission has already run a security review of 555 financial companies and found shortcomings at 130, including missing security patches and no real-time monitoring (KDI policy material).

Bithumb, for its part, has been running a campaign warning customers that leaked personal data is being reused in follow-on phishing and remote-access scams. The confirmed scope remains uneven across the latest cases: Daishin has reported customer data exposure, while Bithumb and Mirae Asset Global Investments are still distinguishing staff or internal-system access from the possible theft of member or personal credit data.