South Korea’s second-largest crypto exchange, Bithumb, confirmed a data breach on October 28, disclosing that unauthorized external access had compromised its internal mobile groupware system a day earlier.
The breached system is Daou Office, an outsourced employee messaging platform. Bithumb has reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission.
The exchange stressed that the compromised system runs on a fully separated network from its trading platform, meaning customer virtual assets cannot be accessed through this breach. Bithumb has not yet confirmed how many individuals were affected or whether customer data, beyond employee records, was exposed. No abnormal withdrawals or customer asset losses have been reported.
Part of a Wider Wave Hitting South Korea’s Financial Sector
The Bithumb breach did not occur in isolation. On the same day, Daishin Securities confirmed that personal and credit information belonging to 38,490 customers—including names, emails, addresses, login IDs, and bank details—was compromised after suspicious access to its account-opening server.
Mirae Asset Global Investments also activated emergency procedures after detecting abnormal access, though it said investor information was not affected.
Regulators have now counted at least 20 financial firms caught in the latest wave, with 4.4 million scanning attempts logged from October 21 alone. Authorities say most source IP ranges are classified as North Korean, though officials caution that “IP addresses alone cannot establish an attacker’s nationality or affiliation.”
The broader attack pattern is suspected to be AI-assisted and traces back to a Shinhan Bank breach reported on September 30. The investigation is ongoing.
For users, the immediate risk is elevated phishing and social engineering attempts using any leaked personal details. This is not a wallet drain, but it dents the exchange’s operational credibility at a delicate moment.
Korean exchanges have previously moved in lockstep on security threats. Upbit and Bithumb coordinated a swift response to a $675,000 SAND token mint exploit on Base earlier this year, suspending deposits and issuing trading cautions within hours. The speed of that coordinated response contrasts with the murkier picture emerging from this internal breach.
Separately, crypto firms have flagged exposure to web-layer vulnerabilities like the PHP2Shell flaw, underscoring that exchange security risks extend well beyond hot-wallet exposure. For comparison, Bitget lost $350 million in a hot-wallet exploit—a different attack class, but a reminder of what uncontrolled access can cost.
Investor Implications: IPO Timeline and Regulatory Pressure in Focus
Timing matters. This year has already been turbulent for Bithumb’s operational record.
In February, a promotional campaign error triggered a phantom transfer of roughly 620,000 BTC, valued at over $40 billion, to 249 users. Lawmakers grilled Bithumb’s CEO over the error, and the exchange recovered 99.7% of phantom balances while covering a 1,788 BTC shortfall from reserves.
That incident set off a formal internal overhaul. Bithumb’s 2028 IPO roadmap now hinges on demonstrating stronger internal controls in 2026, filing for a preliminary listing review in 2027, and executing a full public offering in 2028. A data breach in the middle of that “controls strengthening” year sends the wrong signal to prospective IPO investors.
The regulatory backdrop adds further weight. South Korea’s 22% crypto gains tax takes effect January 1, 2027, covering gains above KRW 2.5 million (~$1,740). Domestic exchanges like Bithumb are already bracing for possible volume migration to offshore platforms. Add a data breach to that mix, and user confidence becomes harder to maintain.
Korea’s FSC is also weighing market-maker rule reforms and broader liquidity structure changes, all of which affect the regulatory environment in which Bithumb must execute its IPO plan.
The latest Bithumb data breach may not have touched user funds, but it adds to a growing list of control failures that regulators and investors are watching closely.
