South Korean cryptocurrency exchange Bithumb has confirmed a cyberattack on its internal mobile work system that resulted in the exposure of personal information, raising concerns about potential customer data leaks.
The breach was discovered on October 27, 2026, and publicly reported on October 28, according to South Korean news agency Yonhap and local media. Bithumb said an unauthorized external party accessed its internal mobile groupware system, which employees use to communicate and perform administrative functions.
The exchange confirmed that employee-related information was among the exposed records but said it was still investigating whether customer information had also been compromised. Bithumb has not disclosed the number of affected individuals, the specific categories of exposed information or the identity of the attackers.
The company maintained that its internal administrative infrastructure is separated from its cryptocurrency trading platform, meaning the intrusion did not provide direct access to customer digital assets. No cryptocurrency theft has been confirmed in connection with the incident.
Bithumb Reports Breach to South Korean Authorities
According to local reporting, Bithumb identified suspicious external access to its mobile groupware system on October 27. The company subsequently reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission.
Bithumb began examining the extent of the unauthorized access, including whether information belonging to exchange members was stored within the compromised system. Initial findings indicated that the exposed records primarily concerned employees.
However, investigators have not ruled out the possibility that customer information was also accessible. Bithumb said it would provide further details as its investigation progressed.
The exchange also notified affected employees and indicated that additional customer protection measures could follow if member information was confirmed to have been exposed. The distinction between administrative and trading infrastructure is important for assessing the severity of the incident.
While a compromise of internal communications systems can expose sensitive information and create opportunities for phishing or impersonation, it does not necessarily indicate that attackers obtained control over cryptocurrency wallets. Bithumb’s statement that the systems are segregated therefore reduces the immediate concern about direct asset theft.
Nevertheless, the full implications remain uncertain until investigators establish the scope of the data exposure and the method used to access the system.
Breach Adds to Wider Wave of Financial-Sector Attacks
Bithumb’s disclosure coincided with reports of separate cyberattacks involving South Korean brokerage Daishin Securities and asset manager Mirae Asset Global Investments. Daishin confirmed that personal information belonging to 38,490 customers had been exposed following unauthorized access to a server connected to online account-opening services.
The compromised information included names, email addresses and mobile phone numbers. Mirae Asset Global Investments also reported unauthorized access, prompting an investigation by financial authorities.
Reuters reported that South Korea had experienced cyberattacks affecting 16 financial companies, including banks, with approximately 100,000 reported data exposure cases as of earlier in October. The incidents have increased scrutiny of cybersecurity standards across the country’s financial services industry.
South Korea’s Financial Supervisory Service is assessing the latest breaches as regulators examine the effectiveness of security controls and incident-response procedures. For cryptocurrency exchanges, the attacks demonstrate that security risks extend beyond digital asset custody and blockchain infrastructure.
Employee communications platforms, administrative systems and customer information databases can also become targets, potentially exposing users to identity theft and social engineering. Bithumb has previously faced operational scrutiny, including a February 2026 incident in which an internal processing error temporarily credited customers with approximately 620,000 Bitcoin.
That incident was an accounting mistake rather than a cyberattack and should not be conflated with the latest breach.
For now, Bithumb’s immediate priorities are identifying the compromised records, determining whether customer information was exposed and preventing further unauthorized access. The incident remains an information-security breach, with no confirmed loss of customer cryptocurrency.
