Daishin Securities Hack Exposes Data of 38,490 Customers

Regulators Dispatch On-Site Teams to Bithumb and Daishin

South Korea's financial regulators sent inspection teams into the country's crypto and securities sectors on Wednesday after confirming hacking incidents at three more institutions, including the crypto exchange Bithumb. The Financial Supervisory Service said it became aware on October 28 of breaches at Bithumb and at brokerages Daishin Securities and Mirae Asset Global Investments, and dispatched on-site teams to Daishin and Bithumb the same day. If the inspections uncover legal violations, the cases will be converted into formal prosecutorial referrals.

Daishin Securities bore the heaviest confirmed damage. In a press release issued Wednesday morning, the brokerage said the personal and credit information of 38,490 customers had leaked. The company said it detected abnormal access by an outside actor to a server linked to non-face-to-face investment account opening on October 17, reported it to regulators at the time, and established the customer data leak through a subsequent internal investigation.

Bithumb, one of Korea's largest virtual asset exchanges by volume, told authorities it identified unauthorized access to an internal mobile groupware system on Tuesday, October 27. Only employee information is confirmed leaked so far, and the exchange is still analyzing whether member data was included. In its report to regulators, Bithumb said information that could be used for fraudulent payments or crypto transfers, such as wallet addresses, was not exposed. Mirae Asset Global Investments said it spotted abnormal access from an external IP address on some web systems, blocked the route and activated an emergency response, with no unique identifiers, sensitive data or personal credit information leaked, and no investor data affected.

The Financial Services Commission convened an emergency virtual-asset sector review Wednesday afternoon, led by digital finance policy officer Yu Young-jun, with the FSS, the Financial Security Institute, the DAXA exchange joint council and Bithumb attending. FSS Governor Lee Chan-jin told bank holding company board chairs that as artificial intelligence is adopted as a hacking tool, weaknesses will be found faster and coordinated attacks will become constant. The commission plans a broader AI-hacking response meeting next week with regulators, ministries, industry associations and the heads of Korea's five major commercial banks, and said it will extend security requirements to sectors currently outside the Electronic Financial Transactions Act.

Police Probe a Link to the Earlier Bank Hacks

The National Police Agency assigned the new cases on Wednesday morning to the same unit that has been investigating a wave of AI-assisted attacks on South Korean banks, and is comparing techniques across incidents to establish whether they share a source. The earlier wave had exposed roughly 100,000 records at 16 financial companies as of October 14, according to a Korean government policy archive. A police official told Seoul Economic Daily, “We are not ruling out the possibility that this was an attack by the same person behind the bank hacking case.”

That earlier wave is tied to ARTEX, a China-built open-source agentic penetration-testing tool that runs alongside large language models such as Claude Code, built by Anthropic. Security firm CrowdStrike reported recovering the attacker's Claude Code session logs, ARTEX configuration files and memory files in exposed server directories, and assessed with moderate confidence that a financially motivated, Chinese-speaking operator was responsible. The operator's own opsec failures, including using the same tooling to draft a resume, leaked contact details that CrowdStrike said may point to a 26-year-old in Maoming, Guangdong, though the firm conceded the identifiers are not fully reliable. Korean specialists remain skeptical, with a Korea University information security professor questioning whether ARTEX was even the only tool used.

The victim count on the bank side keeps climbing. KB Kookmin Bank said earlier this week that a detailed re-examination lifted its confirmed victims from 119 to 2,210, and Mirae Asset Life Insurance, a separate entity from the asset manager, drew an urgent FSS on-site inspection after detecting its own intrusion. A commission review of 555 financial companies found shortcomings at 130, including missing security patches and no real-time monitoring, and Bithumb is running a campaign warning customers that leaked data is being reused in follow-on phishing and remote-access scams.

COINOTAG's read: the movement from banks into brokerages and an exchange within days points to a single campaign still expanding rather than three isolated accidents, and the FSC's plan to impose major-bank security standards on sectors outside the Electronic Financial Transactions Act would land directly on exchanges like Bithumb. The concrete test is next week's meeting: whether Korea converts the 130 flagged shortcomings into enforced remediation, and whether police confirm the ARTEX link, will decide if this becomes a structural tightening of crypto exchange security or another episodic response.