Bithumb Confirms Internal System Breach as Data Leaks Hit Three Korean Firms

Bithumb, South Korea's second-largest cryptocurrency exchange, said an unauthorized outside party accessed its internal mobile groupware system and leaked personal information, Yonhap News Agency reported on Wednesday, local time.

The exchange is investigating whether customer data was among the exposed records, according to Reuters, citing Yonhap. An industry source told Yonhap that some personal information belonging to Bithumb customers had already leaked. Bithumb has not disclosed how the intruder reached its systems, and the scope of the exposure remains unverified.

The claim that customer data is under review deserves scrutiny. The company confirmed the breach of internal systems; the suggestion that clients were affected comes from an unnamed industry source, not from Bithumb itself. In plain words: the intrusion is confirmed, the customer impact is not.

Who else was hit?

Bithumb was one of three South Korean financial firms to report data breaches that day.

• Daishin Securities said the personal information of 38,490 customers — names, email addresses and mobile phone numbers — was leaked after the brokerage detected signs of unauthorized access last week. It pledged to compensate customers for any resulting damage in accordance with the law.
• Mirae Asset Global Investments, an asset manager, confirmed a separate hacking incident.
• Bithumb reported the groupware breach described above.

Financial authorities have begun an inspection of the incidents. Spokespeople for the three firms could not be immediately reached for comment by Reuters.

The breaches fit a wider pattern. Earlier this month, the Financial Services Commission said a wave of hacking attacks had struck 16 South Korean financial firms, including banks, causing roughly 100,000 data leaks — an average of more than 6,000 records per institution affected.

What did CZ say?

The Korean disclosures landed the same day Coinbase said a security incident at analytics vendor Amplitude had exposed some of its customers' contact data. Binance founder Changpeng "CZ" Zhao listed all four incidents in a post on X on Wednesday.

"You can't prevent a leak, but you can protect yourself," Zhao wrote. He urged users to sign up to each exchange with a unique email alias, avoid text message-based two-factor authentication and ask their phone carrier for a number lock. Leaked addresses and holdings data "have led to real-world extortion and robberies," he added.

His warning carries weight even if his framing is self-interested. Leaked exchange data "is mostly used for phishing, SIM swapping, and social engineering," Zhao wrote — attack vectors that target users rather than platform wallets.

Separately, South Korea's Science Ministry and the Korea Internet & Security Agency urged website operators to check for recently disclosed flaws in PHP, the programming language behind much of the web, which let attackers run commands on a server without logging in. The advisory does not confirm a connection to the Bithumb incident; the timing invites the question, but no evidence links the two yet.

A turbulent year for Bithumb

The breach is the latest setback for the exchange in 2026.

In February, Bithumb mistakenly credited 695 users with a total of 620,000 BTC — worth roughly $43 billion at the time — during a promotion meant to distribute small cash rewards. The deposits existed only on Bithumb's internal ledger, and the exchange said it recovered 99.7% of the Bitcoin.

In March, South Korea's Financial Intelligence Unit fined Bithumb 36.8 billion won, about $24.6 million, and ordered a six-month partial suspension over anti-money laundering failures. A Seoul court blocked the suspension in April.

CEO Lee Jae-won was booked as a bribery suspect in June over the alleged hiring of a National Assembly member's son. Bithumb has since set out a three-stage plan to list on the stock market in 2028.

In plain words: an exchange with regulatory and governance baggage now faces a data-breach inquiry just as it prepares for a public listing. Expect the ongoing inspection, and whatever it determines about customer data exposure, to shape that timeline.