Bithumb Intrusion Into Staff Messaging System Joins Wave of Korean Financial Hacks

Por Coinvote

Publicado em October 28, 2026 - 11:24 UTC | 4 mins de leitura

Bithumb says an outside party got into the internal mobile system its staff rely on, and it is still working out whether customer information was exposed. The breach landed on the same day two Korean securities and asset-management firms disclosed their own incidents.

Bithumb says an outsider reached its employee system

Bithumb, the number-two crypto exchange in South Korea, reported that someone outside the company got into the mobile system its staff use for work and internal messaging. Yonhap News Agency broke the story on Wednesday. Decrypt relayed Yonhap's account that personal information had leaked, and an industry source told Yonhap that some customer information was among it.

The exchange has not confirmed that members were affected. It told Yonhap it was analyzing the exact scope, "including the possibility of member information being involved," as quoted by CoinDesk and Cointelegraph. CoinDesk added that, as of the afternoon in Asia, no losses of crypto funds had been reported.

Why a staff messaging tool still matters to customers

Bithumb says the affected system is isolated from the platform where customers trade, meaning client crypto holdings cannot be touched through this intrusion. That separation is the main reason no loss of funds has been reported. It does not settle whether names, contact details or other records sat in the compromised system.

Internal collaboration tools often hold employee directories, chat histories and shared files. Attackers who get in can use them to learn how a company operates and whom to impersonate. Binance founder Changpeng "CZ" Zhao made a related point on Wednesday, according to Decrypt, saying that stolen exchange data tends to feed phishing, SIM-swap and social-engineering schemes.

Decrypt also reported that Bithumb has not said how the system was accessed. Separately, the Science Ministry and the Korea Internet & Security Agency asked site operators to look for newly disclosed PHP vulnerabilities that allow remote command execution without authentication. Decrypt did not link that advisory to Bithumb, so the connection remains an open question.

The numbers that frame the incident

The outlets give a consistent set of figures for the day, though most concern other firms rather than Bithumb itself.

38,490: customers of brokerage Daishin Securities whose personal information leaked, according to all three outlets.
16: South Korean financial firms hit by cyberattacks as of Oct. 14, per Financial Supervisory Service Governor Lee Chan-jin, as reported by CoinDesk and Cointelegraph.
Around 100,000: data leaks tied to attacks on 16 financial firms, according to the Financial Services Commission as cited by Reuters through Decrypt.
Tuesday: the day Bithumb found the intrusion and notified the Korea Internet & Security Agency and the Personal Information Protection Commission, per CoinDesk and Cointelegraph.
Three: firms the Financial Supervisory Service was reviewing on Wednesday, per CoinDesk.

How the outlets' accounts line up and where they diverge

All three outlets trace the story to Yonhap and agree on the timeline of discovery on Tuesday and disclosure on Wednesday. They also agree that Bithumb says its trading systems are walled off from the breached tool. Cointelegraph noted it had asked Bithumb for further comment.

The emphasis on customer exposure differs. CoinDesk wrote that personal information was taken, while Decrypt and Cointelegraph framed the exchange's own position as an investigation into whether member data was compromised. Only Decrypt carried the industry source's claim that some customer information leaked, and that claim is unconfirmed by Bithumb.

Accounts of Mirae Asset Global Investments also vary. Decrypt said the asset manager confirmed a hacking incident and that regulators began an inspection. CoinDesk and Cointelegraph said Mirae stopped unusual access to part of its web infrastructure and that investors' data was unaffected, which Cointelegraph attributed to Yonhap. Decrypt additionally mentioned a Coinbase vendor, Amplitude, that exposed some users' contact details, which the Korean-focused reports did not cover.

Even the 2026 figures differ slightly. Decrypt put the February mistaken credit at about $43 billion at the time, while CoinDesk said more than $40 billion.

A second blow to Bithumb's controls this year

In February, Bithumb wrongly credited 695 users with 620,000 BTC in total, according to Decrypt, in a giveaway that was supposed to pay out modest cash prizes. CoinDesk said the intended amount was 620,000 won. Decrypt reported the deposits existed only on the exchange's internal ledger and that Bithumb recovered 99.7% of the Bitcoin. CEO Lee Jae-won blamed weak internal controls, CoinDesk reported.

Regulatory pressure followed. Decrypt said the Financial Intelligence Unit penalized Bithumb 36.8 billion won ($24.6 million) in March for anti-money laundering lapses and imposed a partial business suspension of six months. A Seoul court blocked the suspension in April. Decrypt also reported that Bithumb has set out a staged plan for a 2028 stock market listing and that Lee was booked in June on suspicion of bribery related to the alleged employment of a lawmaker's son.

What to watch as the investigation continues

The first open question is scope. Bithumb has not said how many people's information, if any, was exposed, or whether deposits and withdrawals were affected. The promised official announcement should show whether member records were touched.

The second is cause. If the entry point was a known software flaw, regulators may press exchanges and brokers on patching. Neither Decrypt nor the other outlets established that link.

For customers, the practical step suggested by the reporting is caution with unsolicited messages that mention an account, since leaked contact details are commonly used for phishing. Whether the Financial Supervisory Service assessment leads to any action against Bithumb has not been reported.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$81,256	+1.8%	-2.3%	$1.63 trillion

CoinGecko data as of 2026-10-28 (UTC).

FAQ

Were customer funds stolen in the Bithumb breach?

CoinDesk reported that no loss of crypto funds had been reported by the afternoon in Asia. Bithumb says the breached employee system is isolated from the platform where customers trade, so client crypto holdings cannot be reached through it.

Was Bithumb customer information leaked?

That is not yet confirmed by the exchange. Bithumb told Yonhap it is analyzing the scope, including the possibility that member information was involved, while an industry source told Yonhap that some customer information leaked.

Which other Korean firms reported breaches on the same day?

Daishin Securities said personal information for 38,490 customers leaked. Mirae Asset Global Investments said it stopped unusual access to part of its web infrastructure, and CoinDesk and Cointelegraph reported that investors' data was unaffected.