Bithumb staff data leak prompts on-site inspections by Korean regulators

South Korea's Financial Services Commission said it opened on-site inspections at Bithumb on Oct. 28, hours after the crypto exchange reported that abnormal external access had leaked information belonging to its employees. The regulator published the notice under the headline "Responding closely and swiftly to hacking incidents at major virtual asset businesses such as Bithumb."

Bithumb told an emergency meeting that it had confirmed signs of a leak covering staff at the company, its subsidiaries and partner companies, and that it was still checking whether user information was exposed. The compromised system supports employees at their jobs and is not part of the core computing facilities used for virtual asset trading, the exchange reported. No leak has been confirmed of material that could be used for fraudulent payments or crypto transfers, wallet addresses included.

The Financial Supervisory Service and the Financial Security Institute joined the meeting alongside the exchange industry alliance DAXA, chaired by Yoo Young-joon, the FSC's digital finance policy head, the notice states. Bithumb and DAXA presented the exchange's own report to the agencies coordinating the response, CryptoSlate reported. The three agencies said they started their on-site investigation immediately and would share information to establish the cause. If consumers suffer losses, the commission said it would supervise protective measures including full compensation, and TokenPost reported the agencies will examine the cause as part of that work.

Bithumb detected the unauthorized access on Oct. 27 and reported it that day to the Korea Internet & Security Agency and the Personal Information Protection Commission, TokenPost reported. The number of people affected and the records involved have not been disclosed. TokenPost identifies Bithumb as South Korea's second-largest crypto exchange by trading volume.

The scope that has surfaced so far is narrower than a trading-system breach. An external intrusion into Bithumb's internal mobile work system left information on roughly 600 executives and employees exposed, according to SBS, while a check on whether member data was compromised continues. Bithumb's account to the regulators matches that framing: CryptoSlate reported the exchange described an employee-support system, not the machinery that processes customer trades.

The probe sits inside a broader wave of incidents at Korean financial firms. Daishin Securities leaked names, mobile numbers and credit information for more than 38,000 customers in an Oct. 17 attack on a server used for non-face-to-face account opening, while Mirae Asset Global Investments said it blocked intrusion attempts on some web systems the same day. The FSC's release names Mirae Asset's life insurance and asset management units and additional customer data exposure found during the Daishin investigation. The Financial Supervisory Service dispatched an on-site inspection team, police opened an investigation, and the presidential office's National Security Office held an emergency response meeting, SBS reported.

Those breaches followed a wider security sweep. The government ordered every financial institution to run its own cybersecurity inspection after attacks on banks and savings banks earlier in October, about 20 days before the Bithumb disclosure, SBS reported, and the same failures surfaced again. CryptoSlate noted the FSC had already named two crypto firms in a breach wave on Oct. 15 that also hit major banks, and that the Bithumb notice does not claim the incidents share a technical cause.

The regulator is using the incident to push security standards past the crypto sector's current legal footing. The FSC said it plans measures to bring virtual asset businesses and other sectors not covered by the Electronic Financial Transactions Act up to the safeguards banks and major financial institutions must meet, with rapid incident response in place. Its notice sets out no enacted rule or deadline.

Financial Supervisory Service governor Lee Chan-jin told a separate briefing that institutions must manage their IT assets themselves, find and remove vulnerabilities on their own, and build an autonomous defense system, the English-language report said. The same report said authorities have confirmed roughly 4.4 million attacks from North Korean IP ranges targeting South Korean financial institutions since Oct. 21, mostly scan-type access attempts, with no confirmed successful breach among them. Whether Bithumb's member data was exposed remains under analysis, and neither the FSC nor the exchange has published a final customer-impact assessment.