Bithumb, South Korea's second-largest cryptocurrency exchange, disclosed that an unauthorized external party accessed its internal mobile groupware system, resulting in a leak of personal information. The exchange is currently investigating whether customer data was compromised, although an industry source indicated to Yonhap News Agency that some user details had already been exposed. This incident occurred on Wednesday alongside reported breaches at two other major South Korean financial institutions: Daishin Securities and Mirae Asset Global Investments.
Daishin Securities confirmed that the personal information of 38,490 customers, including names, email addresses, and mobile phone numbers, was leaked after detecting signs of unauthorized access the previous week. The brokerage stated it would compensate affected clients for any damages in accordance with legal requirements. Mirae Asset Global Investments also acknowledged a hacking incident, prompting financial authorities to initiate inspections into both firms. These events follow a broader wave of cyberattacks affecting 16 South Korean financial entities earlier this month, which resulted in approximately 100,000 data leaks according to the Financial Services Commission.
The timing coincides with separate security disclosures from global crypto platforms. Coinbase reported that a vendor breach at analytics firm Amplitude exposed contact data for some users, while Binance founder Changpeng Zhao highlighted the cluster of incidents on social media, warning that leaked exchange data is frequently exploited for phishing and SIM swapping. Bithumb has not yet specified how its system was breached, though South Korean agencies have urged website operators to patch recently disclosed vulnerabilities in PHP. This marks another challenging year for Bithumb, which previously faced regulatory fines for anti-money laundering failures and a significant operational error involving erroneous Bitcoin credits.
The simultaneous disclosure of breaches across three prominent South Korean financial institutions signals a systemic vulnerability within the country's digital infrastructure rather than isolated corporate negligence. For Bithumb, the compromise of internal groupware systems suggests potential weaknesses in employee-facing tools that may serve as entry points for attackers targeting customer databases. The involvement of traditional finance firms like Daishin Securities and Mirae Asset indicates that threat actors are increasingly exploiting common technological dependencies shared across both crypto and conventional banking sectors.
Regulatory scrutiny is likely to intensify as authorities inspect these concurrent incidents, particularly given the recent history of enforcement actions against Bithumb for compliance failures. The exchange’s turbulent year, marked by operational errors and legal challenges, compounds the reputational risk associated with this data exposure. Investors and users should monitor whether the investigation reveals deeper structural flaws in the exchanges' cybersecurity protocols, especially as regulators balance consumer protection mandates with the push for institutional adoption of digital assets.
