Bithumb Breach: Hackers Hit Internal System, Scope Unclear

Bithumb, South Korea's second-largest cryptocurrency exchange by trading volume, confirmed on October 28, 2026 that an unauthorized outside party had breached its internal mobile system a day earlier and leaked personal information. The exchange has not yet said how many people were affected or whether customer records, as opposed to employee data, were taken.

What Bithumb has confirmed so far

According to Yonhap News Agency, Bithumb said an outsider gained abnormal access to its internal mobile groupware system and that personal information had leaked as a result. The company reported the incident the same day it became aware of it to South Korea's Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission, according to Digital Today's account of the disclosure. Information identified so far centers mainly on employee-related data, while Bithumb is conducting internal analysis and has not ruled out the possibility that member information was also included.

Bithumb has drawn a line between this breach and its trading operations. The exchange told Yonhap it was analyzing the exact scope, including the possibility of member information being involved, while maintaining that the breached system runs separately from its trading platform so customer virtual assets cannot be accessed through it, according to CoinDesk's reporting. Reuters, citing Yonhap, reported that an industry source separately said some personal information belonging to Bithumb customers had already leaked, a detail Bithumb itself has not confirmed.

Bithumb was not the only firm to disclose a breach that day. Brokerage Daishin Securities said the personal information of 38,490 customers, including names, email addresses and mobile phone numbers, was leaked after it detected signs of unauthorized access the prior week, and said it would compensate customers for any resulting damage in accordance with the law, Reuters reported via Yonhap. Mirae Asset Global Investments also disclosed a security incident the same day; reporting on that firm's case indicates it blocked an abnormal external access attempt, a separate and apparently less severe event than either the Bithumb or Daishin disclosures.

Key figures at a glance

Why the data-versus-funds distinction matters

The breach disclosed this week is a personal-data incident, not a theft of crypto holdings. Bithumb's own statement, as reported by CoinDesk, says the compromised groupware system runs on a network separate from the exchange's trading infrastructure, and no cryptocurrency withdrawals or losses have been reported in connection with the hack. For a reader holding funds on Bithumb, that distinction matters because a personal-data leak carries a different risk than a theft of account balances: it does not by itself reduce the value of assets on deposit, but it can expose account holders to follow-on risks such as phishing emails or SIM-swap attempts if phone numbers and email addresses are among the records taken. Those follow-on risks depend on exactly which data categories leaked, something Bithumb had not finalized at the time of its disclosure.

The open question for Bithumb customers is scope, not safety of funds. Bithumb has said only that it is still determining whether member records, beyond the employee data already identified, were part of the leak. Until the exchange or regulators publish a confirmed count of affected customers and the specific data fields involved, account holders cannot know whether their own information was part of this incident.

Bithumb's record on security and internal controls

This is not Bithumb's first security lapse. The exchange has a history of major breaches: hackers stole $7 million in February 2017, roughly $31 million in June 2018, and nearly $20 million in EOS and XRP tokens in March 2019, the latter believed by the exchange to be an inside job. Separately from hacking incidents, Bithumb had an internal-controls failure as recently as February 2026, when the exchange mistakenly credited customers with 620,000 bitcoin, reported to be worth more than $40 billion, instead of 620,000 Korean won; Bithumb says it recovered 99.7% of the erroneous credits after restricting trading and withdrawals for the affected accounts. Taken together, this week's disclosure is the latest in a string of control and security problems at the exchange over roughly a decade, though the confirmed scope of the current incident so far is limited to a leak of personal information with no reported loss of customer crypto assets.

The breach also lands amid broader pressure on South Korea's financial sector. The Financial Supervisory Service had said cyberattacks affected 16 South Korean financial firms as of October 14, 2026, according to reporting from CoinCentral, before Bithumb, Daishin and Mirae Asset added three more disclosures on October 28. That timeline indicates the sector-wide wave of incidents predates this week's news and is still being tracked by regulators, rather than being a single event confined to one day.