Bithumb Reports Data Leak Following Internal System Breach

South Korean crypto exchange Bithumb is investigating a suspected data leak after a hack hit its internal mobile system used by employees for internal communications, Yonhap News Agency reported Wednesday. The exchange says it identified the breach on Tuesday and immediately informed South Korean cyber and privacy regulators the same day.

According to Yonhap, Bithumb is working to determine the full scope of the incident, including whether any member information was accessed. Bithumb also stressed that its internal work system is separated from its virtual asset trading infrastructure, suggesting customer virtual assets should remain inaccessible through the breach.

Key takeaways

• Bithumb says it discovered a breach of its internal mobile work system on Tuesday and reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission.
• The exchange is assessing whether the attack involved any “member information,” while indicating its trading system is segmented from the affected internal platform.
• Bithumb told Yonhap that customer virtual assets cannot be accessed through the compromised internal system.
• The incident comes amid heightened cyber concern across South Korea’s financial sector, where regulators report multiple firm-level attacks.

What Bithumb says was hacked

Yonhap reports that Bithumb’s breach involved its in-house mobile system—an internal platform employees use to communicate at work. Bithumb discovered the incident on Tuesday and informed two oversight bodies: the Korea Internet & Security Agency and the Personal Information Protection Commission, according to Yonhap’s account citing industry sources.

In its statement to Yonhap, Bithumb said it is still analyzing the “exact scope” of the attack, including whether member data could have been part of the compromised information. The exchange indicated it plans to publish an official announcement, though Yonhap’s report does not include the details of that forthcoming update.

Critically, Bithumb also drew a line between systems. It told Yonhap that its internal work environment is separated from the virtual asset trading system, adding that the breach does not provide a path to access customer virtual assets.

Why the distinction between systems matters

For crypto exchanges, segmentation between internal employee tools and customer-facing trading operations is often central to risk containment. If an attacker compromises tools used for internal coordination but the trading environment is properly isolated, the threat may be confined largely to data rather than funds.

Bithumb’s explanation—internal system separation from the virtual asset trading system—addresses the concern investors often have in cyber incidents: whether a breach could translate into direct access to custody or trading controls. While the statement does not rule out broader data exposure, it does attempt to clarify what the breach can and cannot reach.

What remains uncertain, based on Yonhap’s reporting, is the precise category of “member information” under review. The investigation’s focus suggests Bithumb wants to understand whether personal or account-related data was obtained, not merely whether the internal messaging system was disrupted.

Regulators point to widening cyber disruption in Korea

The Bithumb case fits within a broader pattern of cyberattacks affecting South Korea’s financial sector. During a meeting at the Financial Supervisory Authority (FSS) headquarters on Wednesday, FSS Governor Lee Chan-jin said cyberattacks had hit 16 South Korean financial firms as of Oct. 14, Yonhap reported, citing comments attributed to Lee.

While the Bithumb incident involves a crypto exchange and its internal systems, the regulatory framing underscores that authorities see cyber risk as an industry-wide issue rather than isolated breaches. For investors and customers, that matters because repeated attacks increase the likelihood that exchanges, banks, and asset managers are facing similar threat vectors—such as attempts to gain access to internal networks, credentials, or sensitive databases.

Recent incidents at other financial firms

Yonhap’s broader reporting also referenced cyber incidents involving other firms in South Korea, highlighting how data exposure can vary even among different types of institutions.

Cointelegraph’s source reporting indicates that the asset manager Mirae Asset Global Investments and Daishin Securities were among recent victims, according to The Korea Times. Daishin Securities reportedly said personal and credit information belonging to 38,490 customers had been leaked. Mirae Asset Global Investments said it blocked abnormal external access to some web systems and was investigating the matter, adding that investor information was not affected.

Those examples illustrate a key asymmetry that Bithumb’s investigation will likely need to resolve: successful attacks do not always produce the same outcomes. In some cases, attackers may obtain data; in others, they may only disrupt systems or trigger access attempts that are contained quickly. Bithumb’s own assertion about system separation suggests the exchange is trying to prevent a “funds risk” narrative even if the “data risk” question remains open.

What to watch next for Bithumb

As Bithumb investigates the incident’s scope, the most important developments for users and market participants will be the exchange’s official findings on whether member information was compromised and what categories of data—if any—were exposed. With South Korea’s regulators already tracking a growing number of financial cyber incidents, the outcome will be closely watched for both data-protection implications and how exchanges demonstrate containment between internal systems and customer assets.