Some customer personal data at South Korea’s second-largest crypto exchange, Bithumb, was reportedly leaked on October 28 after an external unauthorized party accessed one of its internal workplace tools, according to Yonhap News Agency.
What Bithumb and Korean Regulators Have Confirmed
The exchange detected abnormal access by an outsider without authority on October 27 inside its in-house mobile groupware system. The exchange is said to still be working out the exact scope of the breach.
Another firm, Daishin Securities, which was also hit, reported that information on more than 38,000 of its customers, including names, emails, and phone numbers, was leaked. Mirae Asset Global Investment was also a victim.
Korea’s Financial Supervisory Service (FSS) is said to be investigating all three incidents and has already sent an on-site team to Daishin. At a meeting with the chairmen of eight bank holding companies, FSS Director Lee Chan-jin pressed the financial sector on IT security, saying: “As artificial intelligence is used as a means of hacking, security vulnerabilities will be easily detected and simultaneous attacks will become a regular occurrence.” He added that boards must now take the lead in improving the security capabilities of their companies.
Binance co-founder Changpeng Zhao (CZ) also reacted to the news, telling his 12.9 million followers on X that while they may not be able to prevent leaks, they could take measures to protect themselves, including reducing the information they share and locking down their accounts. Leaked exchange data, he pointed out, mostly feeds phishing and SIM-swapping attacks, and he recommended using a unique email alias for each exchange and hardware keys or passkeys instead of SMS codes.
“Assume anyone who contacts you about your account, ‘security issues,’ or ‘refund recovery’ is a scammer, even if they know your name, balance, or recent trades,” CZ cautioned.
Customer Data Breaches on the Rise
The Bithumb case has come right in the middle of other security disclosures involving crypto businesses. Hardware wallet maker Foundation said yesterday that its customers had been hit with more than 23,000 phishing emails sent from its official domain after hackers compromised its API keys on Cloudflare.
In August, a Trezor provider named ShipMonk had the names, locations, and emails of more than 67,000 users stolen. More recently, Keystone Wallet, another major provider, reported that unauthorized people accessed its official website and stole the shipping information of its customers, although they did not compromise wallet passwords and private keys.
There was also an incident today involving Amplitude, a Coinbase vendor, where a subset of the exchange’s users reportedly had their contact details exposed, with SlowMist claiming that the hacker had gotten the details of more than 70,000 customers. However, Coinbase support rejected the breach label, stating that it had not seen any evidence of unauthorized people accessing its systems. It also told users that their funds were unaffected.
