Bithumb Confirms Hack of Internal Groupware, Probes Data Leak
South Korea's second-largest exchange says an outside party accessed its internal groupware and leaked personal data. Bithumb says customer assets cannot be reached, but an industry source told Yonhap some customer data leaked, raising phishing risk.
Bithumb says customer coins are safe. Its staff messaging system was another story.
South Korea's second-largest crypto exchange confirmed on October 28 that an unauthorized outside party broke into its internal mobile groupware system and leaked personal information. The exchange says customer funds are not at risk. How much data got out, and whose, is still unknown.
The compromised system is Daou Office, an outsourced employee messaging platform, and the access happened a day before the confirmation. Bithumb found the breach on Tuesday and reported it the same day to the Korea Internet & Security Agency and the Personal Information Protection Commission.
On the question traders care about most, Bithumb was blunt:
"The internal work system is separated from the virtual asset trading system, so customer virtual assets cannot be accessed through this breach."
Bithumb
No abnormal withdrawals or customer asset losses have been reported.
What is not settled
Whether customers are affected is the open question. Bithumb told Yonhap:
"We are analyzing the exact scope, including the possibility of member information being involved."
An industry source told Yonhap that some Bithumb customer data did leak. Bithumb has not confirmed that. It also has not said how the system was accessed or how many people were affected.
A wider wave
Bithumb is not alone. Daishin Securities said personal and credit data of 38,490 customers was leaked, while Mirae Asset Global Investments confirmed a hacking incident but said investor information was not affected.
The tallies vary. South Korea's financial regulator counted 16 financial firms hit as of Oct. 14, with about 100,000 data leaks reported. Another regulator count puts it at no fewer than 20 firms, plus 4.4 million scanning attempts since October 21, with most source IPs classified as North Korean. Officials caution that IP addresses alone cannot establish nationality or affiliation.
South Korea's Science Ministry and KISA have urged website operators to check for recently disclosed PHP flaws that allow remote command execution.
The phishing angle
Even without a single coin moving, leaked contact data is a trading problem. Changpeng Zhao wrote on X that he counted four data leak incidents reported October 28, including Coinbase's vendor Amplitude, and urged users to use unique email aliases, skip SMS 2FA and set a phone number lock. Leaked exchange data, he warned, "is mostly used for phishing, SIM swapping, and social engineering."
The pattern echoes the Amplitude incident at Coinbase, where contact data rather than keys was the exposure and phishing was the main risk.
Context
This lands on an exchange already under scrutiny. In February, Bithumb mistakenly credited 620,000 BTC, about $43 billion at the time, on its internal ledger and recovered 99.7%. In March, the Financial Intelligence Unit fined it 36.8 billion won ($24.6 million) over AML failures; a related six-month partial suspension was blocked by a Seoul court in April.
A groupware breach with no reported fund loss sits a notch below either. But if customer records turn out to be in the leak, expect a wave of targeted phishing aimed at Bithumb users.
