South Korea’s second-largest crypto exchange, Bithumb, detected unauthorized external access to an internal employee system on October 27. According to the Financial Services Commission (FSC) press release of October 28, data belonging to Bithumb employees, subsidiaries, and partner companies was exposed. Whether the Bithumb data breach also affected customer data remains under active investigation.
Our editorial team reviewed the FSC statement of October 28 (translated from Korean) and the Korea JoongAng Daily’s reconstruction, which places this incident within a broader wave of attacks on Korea’s financial sector. A Reuters article, which our brief notes follows the Yonhap wire, was not accessible to our tools and is not cited here.
What Happened at Bithumb on October 27
According to the Korea JoongAng Daily, the access targeted Bithumb’s internal mobile groupware: the set of applications that staff use for email, documents, and internal communications. The FSC describes it as a system supporting employee work, not the core infrastructure used for crypto-asset trading. Bithumb told the newspaper that what was breached was “a system that supports employee tasks, not the main IT infrastructure” (our translation).
For users, the more pressing question is the second one. The FSC stated that, as of October 28, no leak of data usable for fraudulent payments or asset transfers, such as wallet addresses, had been confirmed. Bithumb told the JoongAng Daily: “No leak of this type of data has been confirmed so far” (our translation). Authorities have not disclosed how many people are affected, exactly which data left the system, or what vulnerability enabled the intrusion.
How Korean Regulators Responded
The FSC convened an emergency meeting on October 28, chaired by Yoo Young-jun, director of digital finance policy. Participants included the Financial Supervisory Service (FSS), the Financial Security Institute, DAXA (the association grouping South Korea’s major licensed exchanges), and Bithumb itself. Per the FSC press release, all three authorities immediately launched on-site inspections and began sharing information to identify the root cause. The Korea JoongAng Daily also reported that national police opened a preliminary investigation into attacks on financial intermediaries and exchanges.
The FSC set out three commitments. First, thorough checks to ensure no consumer harm materializes. Second, protective measures, including full compensation, if damage is confirmed. Third, raising the cybersecurity standards of crypto-asset operators to the level of major banks. Crypto operators currently fall outside South Korea’s Electronic Financial Transactions Act, a gap the FSC explicitly flagged. This is not Bithumb’s first brush with regulators in 2026: according to The Korea Times, in February the exchange mistakenly credited 620,000 bitcoin to promotion winners instead of 620,000 South Korean won.
A Wider Pattern: Korean Finance Under Attack
This incident does not stand alone. According to the Korea JoongAng Daily, late September saw breaches at commercial banks and savings institutions, suspected of being carried out with AI agents. On October 26, Daishin Securities confirmed a data leak affecting 38,490 customers, with names, email and postal addresses, mobile numbers, and encrypted account numbers exposed. On October 28 alone, Daishin, Mirae Asset Global Investments, and Bithumb all reported incidents, while Mirae Asset Life Insurance had already disclosed a breach on October 25.
Earlier banking breaches, as reported by the JoongAng Daily, involved 43,246 customers at Yegaram Savings Bank, 25,729 at Shinhan Bank, and 2,210 at KB Kookmin Bank. The AI angle extends beyond Korea: India’s CERT-In documented AI agents reaching live production systems without organizations noticing.
The North Korean IP Trail
The JoongAng Daily reported roughly 4.4 million scanning attempts originating from North Korean IP addresses against the financial sector, with a warning issued on October 21 by South Korea’s integrated security monitoring system. Authorities themselves caution, though, that an IP address alone is not sufficient to identify the actor behind it. An official cited by the newspaper assessed it as more likely that an outside party breached North Korean systems and used those addresses as cover. No source has linked the Bithumb intrusion to North Korea.
The reference is nonetheless sensitive. Groups affiliated with Pyongyang have a long history of targeting the crypto sector, often through people rather than systems, as seen in campaigns using fake job interviews to compromise industry professionals. Our read, stated as such: employee data, even without wallet details, carries real value for anyone preparing targeted phishing attacks against people who work inside an exchange.
The Upbit Precedent
South Korea has been here before. In late November 2025, Upbit, the country’s largest exchange by volume, suspended deposits and withdrawals after an attack that drained approximately 44.5 billion won in Solana network tokens from a hot wallet, a case we covered in our piece on the Upbit $32 million hack. In that case, the target was funds. In Bithumb’s case, based on what has been disclosed so far, the target was an internal system.
The distinction matters, but it doesn’t close the file. The Korean market is steadily bridging crypto and traditional finance, as illustrated by Jeonbuk Bank’s first bitcoin-collateralized loans. The deeper the two worlds become integrated, the more exchange security becomes a system-stability question. That is precisely the framing the FSC adopted when it demanded bank-grade protection standards for crypto operators.
What This Means for European Crypto Users
The regulatory context in Europe differs from Korea’s. Crypto-asset service providers authorized under MiCA fall within the scope of DORA (the Digital Operational Resilience Act), which imposes cyber risk management requirements and mandatory reporting of major incidents to competent authorities. Where personal data is involved, the GDPR also applies, requiring notification to the relevant data protection authority. These are precisely the obligations the FSC says it wants to extend to Korean exchanges.
For users in the UK and EU, the practical lesson is about data, not just funds. Exchanges collect substantial personal information to meet anti-money-laundering requirements, as our research on KYC and AML providers used by European CASPs documents in detail. Any breach can fuel targeted scams. Treating suspicious emails or calls that reference real account details with immediate skepticism remains the first line of defense, as the case of the fake government request that deceived Revolut illustrates.
Bithumb: Confirmed vs. Still Unknown
What is confirmed, and what is not
- Confirmed: unauthorized external access to an internal employee system, detected October 27; data from Bithumb employees, subsidiaries, and partners exposed, per the FSC; on-site inspections by FSC, FSS, and Financial Security Institute launched October 28; no confirmed leak of data usable for transfers, such as wallet addresses.
- Not disclosed: whether customer data is involved; how many individuals are affected; which vulnerability was exploited; who carried out the attack.
- To watch: the outcome of the customer data review; the FSC’s proposed security standards for exchanges; the police preliminary investigation; any direct communications from Bithumb to its users.
The Bigger Picture
Our read, declared as such: the Bithumb case shows an exchange hit not in its vault but in its offices, and a regulator using the episode to argue that exchanges must be treated like banks on cybersecurity. South Korean crypto operators currently sit outside the Electronic Financial Transactions Act, even as banks and intermediaries face a chain of attacks. The FSC promises full compensation in case of harm and bank-grade standards, but has not yet specified how either commitment will be implemented.
Three signals are worth watching. The first is the outcome of the customer data review, which will determine the real severity of the case. The second is whether the FSC tables a concrete legislative proposal to extend banking-level security rules to exchanges. The third is the police investigation into the origin of attacks across the Korean financial sector, including the North Korean IP trail that authorities themselves caution against treating as settled.
Sources
Bithumb and regulatory response: Financial Services Commission, press release of October 28, 2026; Korea JoongAng Daily, October 28, 2026. February precedent: The Korea Times, February 9, 2026.
