South Korea's financial regulators have begun on-site inspections at Bithumb after the crypto exchange reported signs that abnormal external access had exposed employee information, according to an Oct. 28 notice from the Financial Services Commission (FSC). Bithumb said it is still checking whether customer data was leaked.
The FSC said the information involved employees of Bithumb, its subsidiaries and partner companies. At an emergency meeting, Bithumb said the affected system supports employees' work and is not part of the core computing facilities used for crypto trading.
Customer exposure remains unresolved
According to the FSC, Bithumb has not confirmed a leak of information usable for fraudulent payments or crypto transfers, including wallet addresses. That leaves the broader assessment of possible customer-data exposure unfinished, and the FSC said Bithumb reported that it is still checking whether any customer data was leaked.
The investigation brings the FSC, the Financial Supervisory Service and the Financial Security Institute on site. The FSC said the agencies are sharing information and cooperating closely to identify the incident's cause.
The emergency meeting was chaired by Yoo Young-joon, the FSC's digital finance policy head, according to the notice. Bithumb and DAXA joined the supervisory and security bodies, presenting the exchange's report to the institutions coordinating the response.
Conditional compensation plan
The regulator's response includes a conditional compensation plan. If consumers suffer damage, the FSC said it plans to oversee protection measures including full compensation.
The staff-system disclosure and the continuing customer-data check leave the investigation with different questions to resolve. Bithumb identified the affected system in its report, while the regulators' on-site work aims to establish the cause. The FSC has not announced a completed investigation or a final assessment of customer impact.
FSC targets security gap beyond Bithumb
Alongside the inspections, the FSC outlined plans to strengthen security at virtual asset businesses and in other sectors it says are currently outside the Electronic Financial Transactions Act. It wants their safeguards to match those of banks and other major financial institutions, and it aims for readiness to respond quickly when an incident occurs.
The Oct. 28 notice does not set out an enacted new requirement or an implementation deadline. The proposed response names crypto businesses, but the announcement leaves the specific measures and their timing to be established.
The FSC placed the Bithumb response alongside recently reported incidents at Mirae Asset's life-insurance and asset-management businesses and additional customer-data exposure found during Daishin Securities' investigation. The notice extends the regulator's attention across several financial sectors, without establishing that the incidents share a technical cause.
The earlier backdrop is the South Korean financial-sector breach wave reported on Oct. 15, when the FSC named two other crypto firms. The new Bithumb disclosure adds an immediate inspection response and a specific plan to pursue bank-level security for sectors outside the electronic-finance law.
