Financial authorities have launched an on-site investigation following a data breach at South Korean cryptocurrency exchange Bithumb. The exchange shared findings indicating that employee information had been exposed and is continuing to investigate whether customer data was also affected.
According to an October 28 statement from South Korea’s Financial Services Commission (FSC), the incident also involves employees of Bithumb’s subsidiaries and business partners. No leak of information that could be used in asset transfers, such as cryptocurrency wallet addresses, has yet been confirmed.
Bithumb Detects Breach in Employee System
Bithumb identified unauthorized external access to its internal mobile work system on October 27. Employees use the system to communicate, share files and carry out daily tasks.
The exchange reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission on the day it discovered the breach. It then began reviewing the affected records.
According to local publication Digital Today, initial findings primarily pointed to employee information. Bithumb notified its employees about the incident while leaving open the possibility that customer records were also included in the leak.
The attackers’ identities, their method of entry and the number of people affected remain unclear. The exchange is continuing to analyze the types and scope of the exposed information.
Investigation Into Customer Data Continues
Bithumb said the compromised internal system operates separately from its cryptocurrency trading infrastructure. According to the exchange, attackers cannot access customers’ crypto assets through this system.
No cryptocurrency losses have been reported. However, the exchange has not provided details on whether the incident affected deposit and withdrawal services.
The status of customer information remains under separate review. Investigators are examining whether internal employee messages or shared work files may have contained customer details.
Reports indicate that Bithumb is specifically reviewing files employees sent through the messaging system. The separation of its trading infrastructure therefore does not establish that customer data was unaffected.
Financial Authorities Hold Emergency Meeting
The FSC held an emergency meeting on October 28 with Bithumb, the Financial Supervisory Service, the Financial Security Institute and the Digital Asset eXchange Alliance (DAXA). During the meeting, Bithumb briefed authorities on findings related to information leaks involving employees of the exchange, its subsidiaries and business partners.
The commission said the relevant agencies had begun on-site inspections. Investigators are focusing on the cause and scope of the attack, along with its potential impact on customers.
The FSC also said it would oversee consumer protection measures, including full compensation if losses occur. This statement does not mean that customer losses have been established or that Bithumb has launched a compensation program.
Other South Korean Financial Firms Report Attacks
The Bithumb incident comes amid a series of security breaches across South Korea’s financial sector. According to Reuters, citing Yonhap, Daishin Securities and Mirae Asset Global Investments were also among the companies reporting attacks.
Daishin Securities said personal and credit information belonging to 38,490 customers had been leaked. That figure refers to Daishin customers; Bithumb has not yet disclosed how many people were affected by its own breach.
Mirae Asset Global Investments said it had blocked abnormal access to some of its web systems. The company stated that investor information was unaffected.
The companies’ statements describe different systems and impacts. Publicly available information does not confirm that the same attackers were responsible for these incidents.
Earlier this month, South Korean authorities said cyberattacks had affected 16 financial institutions, including banks. The next key development in the Bithumb investigation will be determining whether customer records were among the exposed data and establishing the number of people affected.
