Bithumb, South Korea's second-largest cryptocurrency exchange by trading volume, has confirmed that an unauthorised outsider broke into its internal mobile groupware system on 27 October and took personal data on 6,444 customers and 715 employees and contractors. Bithumb's own website notice, published on 29 October, says data on 5,600 of those customers was in encrypted files that cannot be read. The other 844 customers had readable data taken. For some of them, that data includes resident registration numbers, driver's licence numbers, bank account numbers and copies of identity documents. The exchange says no trading systems, customer databases or crypto assets were compromised. South Korea's financial regulators have started on-site inspections.
What Happened
Bithumb's notice says the intruder accessed Dawoffice, the company's internal mobile groupware platform, between 11:28 and 12:27 on 27 October and removed stored personal information and files without authorisation. Staff use the platform for work communications, messaging and file sharing. Bithumb says it detected abnormal access at 12:14, then blocked the access route and shut down the groupware system completely. Its own timeline shows the intruder's session continued for about 13 minutes after detection.
Accounts differ slightly on when Bithumb reported the incident. Bithumb's Korean-language notice says it reported to the Korea Internet & Security Agency (KISA) at 23:39 on 27 October and to the Personal Information Protection Commission at 00:48 on 28 October. The Asia Business Daily reports the KISA filing as 11:39, which would be before detection. The notice's 23:39 is the more plausible time. Bithumb says it will file supplementary reports as its investigation continues.
The disclosure came out in stages. On 28 October, CoinDesk and Decrypt, both citing Yonhap, reported that Bithumb had confirmed only that employee information was taken and was still checking whether customer data was involved. Decrypt added that an industry source had told Yonhap some customer data had leaked. The same day, the Financial Services Commission (FSC) said the confirmed exposure covered employees of Bithumb, its subsidiaries and partner firms. Bithumb's 29 October notice then confirmed that its further investigation had also found customer data. The Seoul Economic Daily notes that the incident was first described as an employee-only leak.
The FSC held an emergency meeting on 28 October on cybersecurity incidents in the virtual asset industry. Yoo Young-joon, the FSC's head of digital finance policy, chaired it. The Financial Supervisory Service (FSS), the Financial Security Institute, the Digital Asset Exchange Alliance (DAXA) and Bithumb attended. Yonhap Infomax and CryptoSlate report that the FSC, FSS and Financial Security Institute began on-site investigations right away. Bithumb has set up an incident response task force and is running security checks and applying patches with the groupware vendor. Bithumb has not named the vendor.
What Was Taken
Figures from Bithumb's notice, which other outlets repeat:
- Customers affected: 6,444 in total
- 5,600 whose data was in encrypted files. The Asia Business Daily describes these as DRM-protected and says they could not be opened outside the company.
- 844 whose data was readable
- Employees and contractors: 715 (646 employees, plus 69 staff from partner firms and other outside personnel)
- Total people affected: 7,159, as the Seoul Economic Daily calculates
- People with readable data exposed: about 1,559 (844 customers plus 715 staff). The Seoul Economic Daily rounds this to "about 1,500".
The exposed data types are names, mobile phone numbers, email addresses, resident registration numbers (Korea's national ID number), driver's licence numbers, bank account numbers and copies of identity documents. Bithumb and the Asia Business Daily say the data taken differed from customer to customer, so not all 844 people lost every data type. The 844 figure in the headline is the number of customers with readable data. Bithumb has not said how many of them had ID numbers or document copies exposed.
According to the FSC, Bithumb had not found any leak of data that could be used for fraudulent payments or crypto transfers, such as wallet addresses. Bithumb says it began contacting affected customers individually by text message on 29 October and has added a lookup tool to its website so any user can check whether they were affected. All 715 staff have already been notified.
Why It Matters
The exchange's main systems were not breached, and they did not need to be. The Seoul Economic Daily notes that commentators had already raised this risk: if staff pass customer records around in messages and file attachments, an attacker can collect personal data without touching the trading platform. That is what happened here. Customer KYC material, including ID document scans, was sitting in a collaboration tool outside the protections applied to the customer database.
The split between encrypted and readable files points to the same problem. All the records came from one system, yet some were protected and some were not. The Seoul Economic Daily reports industry speculation that staff may have decrypted files to share them during work, or sent personal data as plain text. Bithumb has not explained the difference. Either explanation means the DRM controls were bypassed by normal work practice, not by the attacker.
Copies of identity documents combined with resident registration numbers are what fraudsters need for identity theft, opening accounts in a victim's name, and convincing voice-phishing calls. Bithumb's notice specifically warns of scams in which callers pose as Bithumb staff. It also warns of fake requests to reset or disable OTP, fake requests to change withdrawal addresses, and fake token-listing offers.
The breach is part of a wider pattern. Bithumb was one of three financial firms the FSS was assessing on 28 October. Daishin Securities disclosed a leak of personal and credit information for 38,490 customers, and Mirae Asset Global Investments said it had blocked abnormal access to some of its web systems. Decrypt, citing Reuters, reports that the FSC said earlier this month that attacks on 16 South Korean financial firms, including banks, had caused around 100,000 data leaks. The FSC says it will significantly tighten security rules for virtual asset firms, which are not currently covered by the Electronic Financial Transactions Act. It also says it will closely supervise compensation if customers suffer losses. Bithumb says it will take responsibility for all confirmed damage. CoinDesk notes that this incident follows Bithumb's erroneous credit of about $40 billion in Bitcoin to customer accounts in February. That event was an operational error, not a breach, but it adds to scrutiny of the exchange's internal controls.
The Attack Technique
The way in has not been disclosed. Bithumb says the specific cause is still under investigation. Since it is patching with the groupware developer, a flaw or misconfiguration in Dawoffice or the way it was deployed is a reasonable line of inquiry. Neither Bithumb nor any regulator has confirmed whether the attacker used a software vulnerability, stolen credentials, or a compromised employee device. No threat actor has been named, and no group has publicly claimed the attack.
Known facts about how the intrusion played out:
- Target: the mobile-facing internal groupware platform. Messages and stored files were accessed, not just account directory data.
- Dwell time: about 59 minutes, from 11:28 to 12:27, which suggests the attacker moved quickly to take what they could.
- Detection gap: abnormal access was flagged 46 minutes into the session, and data access went on for about 13 more minutes before containment took full effect.
- Exfiltration: files were removed in bulk. The encrypted portion was taken along with everything else, and Bithumb says it cannot be read.
What Organizations Should Do
- Treat collaboration platforms as stores of regulated data. Scan groupware, chat and file-sharing systems for national ID numbers, account numbers and ID document images. Remove what you find and block future uploads with DLP rules.
- Keep KYC documents in a controlled system. ID scans and identity numbers should only be viewable through systems with access logging. Staff should not move them as decrypted attachments. If staff can strip DRM to share a file, audit how often that happens and why.
- Harden mobile access to internal systems. Require phishing-resistant MFA and managed or attested devices for mobile groupware. Restrict access by network or device posture, and alert on unusually high download volumes from a single session.
- Make containment faster than detection. Bithumb's timeline shows data access continuing after the alert. Pre-authorise SOC staff to revoke sessions, disable accounts and take a SaaS application offline without waiting for approval.
- Track vendor patches for collaboration software. Ask groupware providers for security bulletins, apply fixes quickly, and review vendor-held admin access and API integrations.
- Prepare customers for impersonation fraud. Once ID data leaks, expect voice-phishing and fake staff contact. Publish clear statements about what your staff will never ask for, add friction to OTP resets and withdrawal-address changes for affected accounts, and increase monitoring for unusual withdrawals.
Sources: Bithumb hacking affects 6,444 customers; 844 exposed ID numbers and... | Bithumb Internal System Hack Leaks Personal Information of 844 Cust... | Bithumb hacked through employee system as South Korean financial fi... | Bithumb Says Hackers Accessed Internal System, Leaking Personal Dat... | Bithumb hack leaks staff data and regulators launch raid | 공지사항 - No.1 가상자산 플랫폼, 빗썸 | Financial Authorities Launch Emergency Probe Into Bithumb Hacking I... | Bithumb Hack Also Leaked Hundreds of Customer Records - Seoul Econo...