SKN | Bithumb Investigates Data Leak After Internal System Breach in South Korea

Key Points

• Bithumb reported a breach of its internal employee mobile system and is investigating whether customer information was exposed.
• The exchange notified South Korea’s cybersecurity agency and personal information regulator on October 27, stating that its internal work system is separate from its cryptocurrency trading infrastructure.
• South Korea’s financial sector has faced multiple cyberattacks, including incidents involving Daishin Securities and Mirae Asset Global Investments.

Bithumb Investigates Potential Data Exposure

South Korean cryptocurrency exchange Bithumb is investigating a data leak following a breach of its internal mobile system, according to a report by Yonhap News Agency published Wednesday.

The exchange discovered the incident on Tuesday, October 27, involving an in-house platform employees use for internal communication and information sharing. Bithumb notified the Korea Internet & Security Agency and the Personal Information Protection Commission on the same day.

The investigation is focused on determining the extent of the breach and whether customer information was compromised. Bithumb said it was analyzing the possibility that member data had been exposed and planned to issue an official announcement.

The company also emphasized that its internal work system is separated from its virtual asset trading infrastructure. According to Bithumb, the separation means customer cryptocurrency holdings cannot be accessed through the compromised system.

The exchange had not established the full scope of the incident in the report, leaving the potential exposure of personal information unresolved.

South Korean Financial Institutions Face Cybersecurity Pressure

The Bithumb incident comes amid a broader series of cyberattacks affecting South Korea’s financial sector.

Financial Supervisory Service Governor Lee Chan-jin said during a meeting at the authority’s headquarters on Wednesday that 16 South Korean financial firms had been targeted by cyberattacks as of October 14.

Other reported incidents involved asset manager Mirae Asset Global Investments and brokerage firm Daishin Securities, highlighting cybersecurity concerns across both investment management and securities trading.

Daishin Securities disclosed that personal and credit information belonging to 38,490 customers had been leaked. The incident demonstrates the potential scale of customer-data exposure when financial institutions experience security failures.

Mirae Asset Global Investments, meanwhile, said it had blocked abnormal external access to certain web systems and was investigating the incident. According to Yonhap, the company stated that investor information had not been affected.

The incidents differ in their reported outcomes. Daishin Securities confirmed a leak involving customer information, while Mirae Asset reported blocking suspicious access without investor information being affected. Bithumb’s investigation remains focused on determining whether its breach involved customer data.

Separation of Internal Systems and Trading Infrastructure

Bithumb’s statement draws attention to the distinction between employee-facing systems and the infrastructure responsible for cryptocurrency trading and custody.

Separating internal communications platforms from trading systems can limit the pathways through which an incident in one environment affects another. However, the separation does not by itself establish whether personal information stored or accessible through internal systems was exposed.

For exchanges handling digital assets, cybersecurity risks extend beyond the direct compromise of trading infrastructure. Employee systems, internal communications and information-management platforms can also contain sensitive operational or personal data.

The outcome of Bithumb’s investigation will therefore depend on identifying the systems and information affected, as well as determining whether unauthorized access extended beyond the initial breach.

Outlook

Bithumb’s investigation will clarify whether the incident involved customer information and how extensively the internal system was compromised. Its statement that the work platform is separated from cryptocurrency trading infrastructure addresses concerns about direct access to customer assets, but the scope of any personal-data exposure remains undetermined. Across South Korea’s financial sector, the recent incidents underscore the importance of protecting internal systems alongside customer-facing platforms and core financial infrastructure.