Updated 28 Oct 2026, 11:10 UTC: adds the Financial Services Commission’s emergency meeting and on-site inspection, and what Bithumb told regulators.

At a glance

  • Bithumb, Korea’s second-largest crypto exchange, found on Tuesday that an outsider had accessed its in-house mobile groupware and that personal data had leaked, Yonhap reported. It reported the incident to two state agencies the same day.
  • The presidential National Security Office will hold an emergency meeting with Financial Services Commission (FSC) officials on Wednesday afternoon on the Bithumb and Mirae Asset hacks, Yonhap Infomax reported.

Bithumb is “analysing the exact scope, including the possibility that member information is included”, the exchange told Financial News on Wednesday (our translation from Korean).

The exchange says the staff-only system is physically separated from its trading network and that no crypto was taken. It said it would issue an official notice on Wednesday morning, Korea time. CryptoWatchDesk had not seen that notice as of 14:15 KST (05:15 UTC).

What was hit

The target was Daou Office, a groupware and messenger system used only by Bithumb employees, News1 reported. Yonhap Infomax said it was built by an outside contractor.

Bithumb became aware of the unauthorised access on Tuesday, 27 Oct, and believes the attack happened that day, Yonhap said.

It reported the breach to the Korea Internet & Security Agency (KISA), the state cybersecurity body, and to the Personal Information Protection Commission (PIPC), the privacy regulator, on the same day.

News1 said Bithumb is checking both employee data and any customer information held in files shared on the system.

What Bithumb says is safe

“It is a system used only by employees and is separated from the exchange network,” a Bithumb official told Yonhap Infomax (our translation). The exact time of the attack and whether personal data leaked, and how much, are still being checked, the official said.

Bithumb told News1 the separation is physical, so customer assets cannot be reached through the system and no crypto was stolen.

That is the company’s account. The FSC has since set out what Bithumb reported to it; see the update below.

Third crypto incident this autumn

Bithumb is the third Korean crypto business to report a breach recently, after Streami, which runs the Gopax exchange, and the smaller coin-only exchange Prabang, Yonhap said.

Gopax found in early October that some customer accounts had been accessed abnormally since early September, with nicknames and login history viewed, Yonhap Infomax reported. It has notified customers individually and reported to the authorities.

The wider financial sector is also under strain. Daishin Securities has disclosed a leak of about 38,000 customers’ personal data, and Mirae Asset Global Investments has reported abnormal access to some web systems to the FSC and the Financial Supervisory Service (FSS), Digital Times reported. Mirae says no money was lost.

Why it matters: staff tools, not trading engines, are becoming the way in. A third-party tool was also the route in an incident at Coinbase’s analytics vendor disclosed on the same day. Leaked member contact details would expose Bithumb users to targeted phishing even if their coins are safe.

Bithumb competes mainly with Upbit in the won market, where listings and delistings are closely watched, as in Upbit’s record run of delisting notices.

Update: regulators start an on-site inspection

The Financial Services Commission held an emergency inspection meeting on Wednesday with the FSS, the Financial Security Institute, the exchange association DAXA and Bithumb, the FSC said in a press note. Yoo Young-jun, its director-general for digital finance policy, chaired it.

Bithumb told the meeting it had confirmed that information on staff at Bithumb, its subsidiaries and partner companies leaked after abnormal outside access, the FSC said. Whether user information leaked is still being checked.

The breached system supports staff work and is not core trading infrastructure, Bithumb reported. No leak of information that could be used for fraudulent payments or crypto transfers, such as wallet addresses, has been confirmed so far.

The FSC, FSS and Financial Security Institute have started an on-site inspection. If customers suffer losses, the regulator says it will oversee protection measures including full compensation (our translation from Korean).

The meeting, run by the third deputy director’s office of the National Security Office, will share the status of both cases and discuss how to prevent further damage, Yonhap Infomax said. How the breaches happened and whether they are linked has not been established, it added.

Bithumb’s official notice should set out who was affected. KISA and the PIPC will review the report. Bithumb users should treat any message about the incident that asks them to log in through a link as suspect.

Get the region’s ten biggest crypto stories every Sunday in Asia Ten.

This article is for information only and is not investment advice.