Bithumb Reports Data Leak After Internal System Breach

South Korean crypto exchange Bithumb is investigating a potential data breach linked to an attack on its internal mobile system, Yonhap News Agency reported on Wednesday. The company discovered the incident on Tuesday and notified the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission the same day, according to Yonhap citing industry sources.

Bithumb said it is assessing how widespread the breach is, including whether any member information was involved. It also emphasized that its internal work system is separated from the virtual asset trading environment, adding that customer virtual assets cannot be accessed through the incident.

Key takeaways

• Bithumb discovered the breach of an internal mobile system on Tuesday and reported it to KISA and South Korea’s Personal Information Protection Commission the same day.
• The exchange is still determining the scope of the attack, including whether member data was exposed.
• Bithumb says the internal work system is segmented from the trading system, and customer virtual assets are not reachable via this breach.
• The incident comes amid broader cyberattacks affecting South Korea’s financial sector, with regulators citing multiple recent victims.

What happened inside Bithumb

Yonhap reported that Bithumb’s internal mobile system—used by employees for internal communications—was compromised earlier this week. The exchange first identified the breach on Tuesday and moved quickly to engage relevant regulators, notifying both KISA and the Personal Information Protection Commission.

In comments to Yonhap, Bithumb said it is working to determine the exact scope of the incident. The company specifically indicated that its analysis includes the possibility of member information being involved. Bithumb also stated it would issue an official announcement later on Tuesday, though the report did not provide details beyond the investigation being underway.

Crucially for customers, Bithumb drew a line between its internal systems and its custody and trading infrastructure. The exchange told Yonhap that the internal work system is separated from the virtual asset trading system, which it says prevents access to customer virtual assets through the breach.

Why segmentation claims matter to traders

In crypto infrastructure, the distinction between internal communication tools and user-facing trading systems is not a technical footnote—it can directly affect customer risk. If an attacker compromises a corporate device or internal communications channel, the most dangerous outcomes are those that enable privilege escalation or lateral movement into systems handling orders, account balances, or key management.

Bithumb’s claim of system separation suggests that, at least from the company’s perspective, the breach should be contained to employee-facing workflows rather than the trading layer. Still, the exchange’s ongoing investigation indicates that it cannot yet rule out broader impacts, particularly around any information that could be used for identity theft, account takeovers, or social engineering—even if digital assets themselves are not accessible.

Investors and users typically watch for follow-up disclosures that clarify what data, if any, was accessed, and whether attackers could reach authentication systems tied to customer accounts. Yonhap’s report focused on internal work systems and the question of member data exposure, leaving the exact technical impact to be determined.

A sign of stress across South Korea’s financial sector

Yonhap framed the Bithumb incident as part of a wider pattern of cyberattacks targeting South Korea’s financial industry. During a meeting at the Financial Supervisory Authority (FSA) headquarters on Wednesday, FSA Governor Lee Chan-jin said cyberattacks had hit 16 South Korean financial firms as of Oct. 14, according to the report.

The same broader context was reflected in reporting about other recent incidents. The Korea Times, as cited in Yonhap’s article, said asset manager Mirae Asset Global Investments and Daishin Securities had also been victims of cyberattacks.

In those cases, the reported impacts differed by firm. Daishin Securities stated that personal and credit information belonging to 38,490 customers had been leaked. Mirae Asset Global Investments said it blocked abnormal external access to some web systems and was investigating the incident, adding that investor information was not affected, according to Yonhap.

Taken together, the pattern suggests that while not every intrusion leads to financial exposure, attackers are increasingly probing systems that may hold sensitive personal or account-linked information—making the data-handling implications as important as any direct disruption to trading.

What to watch next

Bithumb’s next step is a detailed assessment of how far the breach reached, particularly whether any member information was involved, and confirmation of what data was accessed or exfiltrated. In the near term, regulators and users will likely focus on the exchange’s official announcement and any clarifications around containment—especially whether the compromise remained limited to internal communications or involved downstream systems tied to user accounts.