Bithumb Confirms Data Breach as Cyberattacks Sweep South Korea’s Financial Sector

Bithumb, South Korea’s second-largest cryptocurrency exchange, confirmed on October 28 that an outside party breached its internal mobile groupware system and leaked personal data, according to The Korea Herald’s reporting on the incident. The intrusion arrived inside a wider wave of cyberattacks that has swept across the country’s financial industry in recent weeks, from brokerages and asset managers to insurers and commercial banks.

The tension at the center of the story is the gap between what was breached and what was actually at risk. Bithumb said customer assets were never exposed because the compromised system sits physically separate from its trading network. The data that did leak so far is employee information, not custody keys or user balances. A breach can still be serious while leaving the most sensitive layer untouched, and understanding that distinction is what separates a real assessment of this incident from an overreaction.

What Bithumb’s Breach Actually Exposed

Groupware is the internal collaboration software a company uses for messaging, email, scheduling and document approvals. Bithumb runs its instance through Daou Office, a third-party platform common in South Korean workplaces. Because groupware sits on the administrative side of a business, it typically holds staff details, internal communications and sometimes customer records, but not the production systems that settle trades or hold funds.

Bithumb detected the unauthorized access on Tuesday, October 27, and said the compromised system is not used by customers and is physically separated from its trading network. The exchange reported the breach to the Korea Internet and Security Agency and the Personal Information Protection Commission, and it is still investigating whether any customer data was exposed. That last point is the open question: the confirmed loss is employee information, while the customer-data scope has not yet been determined.

The physical separation matters more than it might sound. In an exchange, the custody and trading layer is the prize an attacker wants, and Bithumb’s own description places the intrusion in a different part of the building, so to speak. The breach is a data-security failure, not a sign that the exchange’s hot or cold wallets were reached.

One Exchange, and a Brokerage with the Bigger Number

Bithumb was not the only firm to disclose an intrusion the same day, and it was not the one with the largest confirmed exposure. Daishin Securities said personal and credit information belonging to 38,490 customers was exposed after hackers gained unauthorized access to a server linked to its online account-opening service. The brokerage detected suspicious activity on October 17 and then reviewed more than 60,000 requests disguised as legitimate service traffic over a 10-day period.

The leaked Daishin information included customer names, email addresses, physical addresses, bank names and account numbers, along with encrypted phone numbers and account details. Daishin said it found no evidence of unauthorized access to its core trading systems and plans to notify affected customers individually and compensate those who suffer losses.

“We acknowledge the seriousness of this breach and sincerely apologize to our customers,” Daishin CEO Jin Seung-wook said. “We will take full responsibility for implementing measures to protect customers and prevent a recurrence.”

Mirae Asset Global Investments, the asset management arm of the Mirae group, separately confirmed unauthorized access to some of its web systems. The firm said it blocked the access routes and launched an emergency response after discovering that information from internal business systems had been exposed, but preliminary findings showed no evidence that sensitive personal information, credit data or investor information was compromised. Its affiliate, Mirae Asset Life Insurance, confirmed a customer data breach earlier in the week, prompting an on-site inspection by the Financial Supervisory Service.

The pattern across the four firms points one way: the attacker is going after administrative and back-office systems, not the core trading and custody infrastructure where the most damaging losses would sit.

The comparison is the surprising part of this story. The crypto exchange, which holds the public’s money, is the entity that reported the smallest confirmed exposure so far, while a traditional brokerage carried the largest single number. In a wave that has swept across banks, insurers and asset managers, Bithumb’s recent security posture on listed assets is only part of a longer pattern of scrutiny for the exchange.

What the Watchdog Says About the Wave

The Financial Supervisory Service, South Korea’s main financial watchdog, dispatched inspectors to Daishin Securities and is assessing the incidents at Bithumb and Mirae Asset Global Investments alongside its ongoing investigation into the Mirae Asset Life Insurance breach. FSS Governor Lee Chan-jin framed the intrusions as a structural problem rather than a one-off event.

“Cyberattacks are becoming increasingly sophisticated, with targets expanding to noncore systems,” Lee said during a meeting with board chairs from eight banking groups. He warned that artificial intelligence could make it easier for hackers to identify vulnerabilities and launch simultaneous attacks, and he urged boards to take direct responsibility for cybersecurity.

“IT security is essential to protecting customers’ assets and information and maintaining trust in finance,” Lee added, according to the report.

The wave follows disclosures earlier this month from lenders including Shinhan Bank, KB Kookmin Bank and Hana Bank, which reported customer data leaks, with savings banks and other institutions also targeted. What began as isolated incidents now reads as a coordinated campaign against Korea’s financial sector, and the regulator’s message is that the perimeter has moved: attackers are no longer only hitting the systems that hold the money.

What Still Has to Be Determined

Three facts will settle how serious the Bithumb incident ultimately is. The first is whether customer data, and not just employee records, turns out to have been exposed. The second is the result of the FSS assessments across the four firms. The third is whether the encrypted fields at Daishin held up under the exposure, since the brokerage said phone numbers and account details were encrypted.

For Bithumb users, the immediate takeaway is narrow: no announcement suggests customer assets or trading infrastructure were touched, and the exchange has said its trading network is physically separate from the compromised system. The residual risk is different. Employee data that leaks today can be used tomorrow in targeted phishing against the same staff, a classic route into higher-value systems, which is why the history of unresolved security incidents around Korean exchanges keeps regulators engaged even when the initial damage looks limited.

The most useful signal to watch is Bithumb’s own determination of the breach scope, which the exchange says is still under analysis, along with the FSS inspection findings and Daishin’s individual notifications to the 38,490 affected customers. Until those land, the story is a data breach with the funds untouched, not a custody failure, and the difference is what a careful reader should hold onto.