South Korean crypto exchange Bithumb has reported unauthorized access to its internal mobile groupware system, raising fresh concerns about user data security at centralized trading platforms. The incident was discovered on October 27, 2026, and reported the same day to the Korea Internet & Security Agency and the Personal Information Protection Commission, according to Yonhap.
The compromised tool is Daou Office, a workplace application used by Bithumb employees for messaging and file sharing, News1 reported. Bithumb has stated that its trading services run on a physically separate network and that no cryptocurrency was stolen. That aligns with security controls the exchange outlined earlier in October, including cold-wallet storage, approval steps for moving customer assets, and access logging for staff handling personal information.
Bithumb has not yet confirmed how many users, if any, had personal data exposed, which fields were involved, or how the attackers gained access. In a statement quoted by Financial News, the exchange said: “We are analyzing the exact scope, including the possibility that member information was included.” So far, reports suggest the exposed information mainly relates to employees, but staff chats and shared files can sometimes contain customer details during support work.
Confusion over reported figures emerged after some outlets attributed a 38,490-customer breach to Bithumb. That number actually belongs to Daishin Securities, which confirmed a leak of personal and credit information for 38,490 customers following unauthorized access to a server linked to online account openings. Digital Today reported that the Daishin review found eight types of data exposed, including names, email and home addresses, phone numbers, bank names and account numbers. Mirae Asset Global Investments was also reported as hit on the same day, though no public finding links the three incidents to the same attacker or entry point.
The breach follows a similar 2017 incident at Bithumb, when an attacker compromised an employee’s home computer and obtained names, email addresses and mobile numbers for about 31,800 users. No passwords were taken at that time, but affected customers later faced phishing calls from people posing as Bithumb staff. Bithumb offered 100,000 won to each affected user and reimbursement of proven losses.
Under Korea’s Personal Information Protection Act, companies must notify affected individuals within 72 hours once they confirm a data leak, and must report to the PIPC or KISA within the same window if more than 1,000 people are affected or if the breach involved illegal outside access. Bithumb has already reported the intrusion. Its official notice board will be the key source for confirming which data types and which users were affected.
