Bithumb Probes Data Leak After Internal System Breach on Oct. 27

Employee Data Confirmed in DaouOffice Hack

Bithumb, South Korea's second-largest crypto exchange, is racing to establish how much data leaked out of a hack of its internal mobile work system, an intrusion it detected on Oct. 27 and reported to regulators the same day. The exchange notified the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission on the day of discovery, South Korean media reports citing industry sources said. The compromised platform is DaouOffice, a collaboration suite developed by Korean software firm Daou Technology, which Bithumb staff use for internal messaging and scheduling rather than customer-facing services. So far the confirmed leak covers employee personal data, but the company is still verifying whether member information was exposed as well, since files shared inside the breached tool may have carried client details into internal chats. The exchange is also reviewing whether conversations and documents circulating in the tool contained customer records. "The personal information we have identified so far is employee data," a Bithumb official told local media, adding that the exact scope and the number of affected people remained under review. For customer funds the picture is clearer: Bithumb said its internal work system and the systems handling trading and customer assets run on physically separate networks, so the order book and custody infrastructure could not be reached through this breach. The company said it has seen no sign of abnormal access to customer assets and promised an official announcement on Wednesday morning once the initial review concludes. Under Korea's reporting rules, operators must alert KISA and the privacy commission promptly after confirming a breach, and Bithumb's same-day filings met that timeline. Bithumb, which set a 2028 IPO timetable this year as it overhauls internal controls, had not posted a public explanation on its website notice page as of midday in Seoul on Oct. 28.

16 Firms Hit Across Korean Finance

The Bithumb incident lands inside a broader wave of intrusions sweeping South Korea's financial sector, one the top financial regulator has put a number on. At a meeting at the Financial Supervisory Service headquarters in Seoul on Wednesday, FSS Governor Lee Chan-jin told an industry gathering that cyberattacks had struck 16 South Korean financial firms as of Oct. 14. The hit list now spans banks, brokerages, insurers and Web3 platforms, and the pattern points at commercial software and web-facing systems rather than any single firm's core ledger. Among recent victims, Daishin Securities said personal and credit information belonging to 38,490 customers had been leaked, and the FSS has sent an on-site inspection team into the broker. Mirae Asset Global Investments blocked abnormal external access to some of its web systems and said investor information was not affected; its insurance affiliate Mirae Asset Life confirmed an intrusion of its own on Oct. 26. Crypto platforms have not been spared. Mid-tier exchange GOPAX disclosed on Oct. 16 that personal data of 7 customers and 2 current or former employees had leaked. A smaller exchange separately reported that outside access on Oct. 2 exposed data of about 20 customers, confirming the intrusion eight days after the access occurred. Each incident triggered the same reporting chain: a same-day filing to KISA and the Personal Information Protection Commission, followed by an investigation into scope. Governor Lee used a regular meeting with the chairmen of 8 bank holding companies to press for stronger information security, warning that once AI is turned into a hacking tool, vulnerabilities become easier to find and multi-point attacks will become the norm. He framed the shift as structural, not a passing spell of incidents: defenses built for a single entry point now face simultaneous probes from many directions.

The Bithumb breach and the 16-firm count point to the same root cause: attackers are targeting commercial collaboration and web-facing software where defenses are thinner, not core trading engines. Bithumb's physical network separation claim, if it holds in the official post-mortem expected Wednesday, would explain why no customer asset loss has surfaced, but the open question is member data riding inside employee files. The exchange has already met its legal reporting duties, and KISA and the privacy commission will judge it on how completely and how quickly the final scope is disclosed. For users, the near-term exposure looks less like theft than FUD and disclosure risk; the confirmed damage so far is staff data, and the promised announcement is the next checkpoint.