Bithumb, South Korea’s second-largest crypto exchange by trading volume, disclosed on October 28, 2026 that an outside attacker had breached an internal mobile system used by its employees. The incident is part of a wider wave of cyberattacks that has hit 16 South Korean financial institutions this October. This analysis separates confirmed facts from open questions and explains what the episode means for digital asset platforms.
🔑 En bref
- Bithumb reports an intrusion into an internal employee mobile system, detected after the compromise and reported to KISA and the Personal Information Protection Commission.
- The exchange says customer virtual assets cannot be reached through this intrusion; the number of affected people has not yet been published.
- Regulators are assessing three cases: Bithumb, Daishin Securities (38,490 clients) and Mirae Asset Global Investments.
- It is Bithumb’s second major internal-control failure of 2026, after the erroneous crediting of 620,000 BTC in February.
An intrusion into an internal tool, with no declared access to customer assets
The compromised system is an internal mobile tool used for professional exchanges and messaging between employees. It was breached on the Tuesday before the announcement, before Bithumb detected the intrusion and notified the Korean Internet & Security Agency (KISA) and the Personal Information Protection Commission.
According to the platform, the system is separated from its trading infrastructure. Bithumb stated that “customer virtual assets cannot be accessed through this intrusion.” That statement narrows the known scope of the attack, but it does not yet establish whether the compromised data was limited to employee records or also included member information. Bithumb has not published the number of people affected and has not confirmed whether deposits or withdrawals were disrupted. No theft of crypto assets had been reported as of the announcement.
A wave of attacks touching several financial players
On October 28, the Financial Supervisory Service said it was assessing three cases: Bithumb, Daishin Securities and Mirae Asset Global Investments. The table below places them in the broader context of incidents reported since early October.
| Institution | Incident | Data or reported impact |
|---|---|---|
| Shinhan Bank | Data breach | 25,000 customers |
| Kookmin Bank | Credit card information | 119,000 customers |
| Hana Bank | Attack via corporate support system | Not specified |
| Daishin Securities | Leak of personal and credit data | 38,490 clients |
| Mirae Asset Global Investments | Abnormal access to web systems, blocked | Investor data reported unaffected |
| Bithumb | Intrusion into internal mobile system | Not yet quantified |
Daishin Securities said an external attack had led to the leak of personal information and credit data concerning 38,490 clients. Another version, cited by The Straits Times, refers to about 38,000 records, most likely a rounding of the same figure. Mirae Asset said investor information had not been affected, while authorities were still assessing the consequences of its incident. Spokespeople for all three firms could not be reached immediately.
The sector-wide picture is larger. According to the Financial Services Commission, cited by The Straits Times, the attacks had already caused about 100,000 data leak cases. The commission had convened an emergency meeting on October 5, 2026, confirming a data breach at Shinhan Bank and incidents involving Kookmin Bank and Hana Bank. At a meeting with bank group executives, Financial Supervisory Service Governor Lee Chan-jin said:
“I understand that major financial investment companies have experienced hacking incidents across the board.”
Lee Chan-jin, Governor, Financial Supervisory Service
A June precedent and a social engineering method
The October 28 incident is not the platform’s first. An attack on June 30 compromised data of 30,000 users, about 3% of the customer base at the time. Exposed fields included names, mobile phone numbers, email addresses and, for some users, the temporary password used for financial transactions. Several accounts were subsequently drained, though the sources give no aggregate amount.
That attack followed an intrusion into Bithumb’s systems enabled by the hacking of an employee’s personal computer. The method was vishing, or voice-based social engineering. The attacker reportedly posed as a Bithumb executive and claimed suspicious activity had been detected on an account, in order to obtain IDs, passwords and security codes. Bithumb then offered to compensate victims while continuing its investigation.
A second internal-control failure in 2026
In February, Bithumb mistakenly credited customers with 620,000 BTC, worth more than $40 billion at the time, instead of 620,000 won. CEO Lee Jae-won attributed the error to a weakness in internal controls:
“The platform is fully aware of the gap in the internal controls of its systems.”
Lee Jae-won, CEO, Bithumb
Two control failures in one year shift the debate. This is no longer only a technical intrusion; it is a question of operational governance, which institutional counterparties scrutinize closely when assessing risk.
Claimed security measures, measured against the facts
On its corporate website, Bithumb says it was the first South Korean digital asset platform to deploy a comprehensive security solution comparable to that of commercial banks. The company highlights the following:
- Network separation, an intrusion blocking and prevention system, and 24/7 monitoring with a South Korean security firm.
- Application of the so-called “5-5-7” framework: 5% of staff devoted to IT specialists, 5% of IT staff dedicated exclusively to data security, and 7% of the total budget allocated to data protection.
- ISMS certification obtained; PIMS and ISO 27001 certifications planned.
- Two cyber insurance policies: comprehensive cover with Hyundai Marine & Fire Insurance and personal information liability cover with Heungkuk Fire & Marine Insurance. The announced maximum is 6 billion won, or 3 billion per policy.
The institutional presentation calls Bithumb the number one digital asset platform and claims the highest security standard in the industry, while CoinDesk ranks it second in South Korea by trading volume. The sources do not clarify whether this gap reflects different ranking criteria. More importantly, the stated safeguards did not prevent the October 28 intrusion, nor the June incident that preceded it.
Sector context and technical leads
South Korean authorities separately warned website operators to check for PHP vulnerabilities. According to The Straits Times, these flaws allowed attackers to run malicious commands on a server without logging in. No perpetrator has been officially identified. Reports pointed to ARTEX AI, an open-source penetration testing tool, and some analysts suspected AI-based attack automation tools were involved. These leads remain unconfirmed.
Carnegie’s timeline of cyber incidents affecting financial institutions counts roughly 200 incidents since 2007 and notes that state-sponsored attacks have become more frequent, more sophisticated and more destructive. In 2017, the G20 warned that cyberattacks could “undermine security and confidence and endanger financial stability.” Fakecalls, a banking trojan discovered in South Korea in 2022, illustrates how attackers can mimic bank apps and pose as employees to obtain payment data.
On the regulatory side, the Financial Services Commission oversees consumer protection and reviews incidents for possible rule changes. On-site investigations were launched with KISA participation. Financial firms were asked to inspect external IT systems, strengthen authentication and access controls, and accelerate threat intelligence sharing. President Lee has also ordered a thorough investigation into personal data leaks.
Outlook and scenarios
The confirmed facts remain narrow: an intrusion into an internal system, no declared access to customer assets, and a still-unquantified volume of personal data at Bithumb. The sources report no price move, trading-volume shift or other market reaction linked to the October 28 disclosure.
Three scenarios remain open. In the base case, the investigation confirms a leak limited to employee data and the exchange publishes a precise tally, containing the damage to user trust. In a less favorable case, the scope extends to member data, bringing complaints, sanctions or account losses that weigh on confidence. In a broader case, the wave of attacks persists across the sector and regulators tighten security obligations for digital asset platforms. Investors should track the final number of affected users, any impact on deposits and withdrawals, and the findings of the regulatory review.
Sources
- CoinDesk, October 28, 2026
- Bithumb, institutional security overview
- JD Supra, report on the earlier attack
- Carnegie Endowment, FinCyber timeline
- The Straits Times, October 28, 2026
- SC Media, brief on South Korean cyberattacks
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
