South Korea’s second-largest crypto exchange Bithumb has confirmed it is investigating a data leak after hackers broke into the internal mobile system its employees use to communicate, according to a Wednesday report from the Yonhap News Agency.
By Carlos Martinez | October 28, 2026
The uncomfortable question for every Bithumb user is simple: did someone get my personal information? The company says it does not know yet — and it says that honestly, in writing. But it also says something every crypto holder on the exchange should find reassuring: the hacked system is separated from the trading system, so customer virtual assets cannot be accessed through this breach.
The Hook: What Actually Happened
Bithumb discovered the breach of its in-house mobile system — essentially an internal chat and workflow app for employees — on Tuesday, according to Yonhap, which cited industry sources. The exchange moved quickly on the regulatory front: it notified the Korea Internet & Security Agency and the Personal Information Protection Commission the same day it found the intrusion.
The company is now investigating the exact scope of the attack. “We are analyzing the exact scope, including the possibility of member information being involved,” Bithumb told Yonhap, adding that it planned to release an official announcement and that customer virtual assets were not reachable through the breached system because the internal work network is separated from the trading network.
In plain terms: hackers got into the staff break room, not the vault. But the staff break room often has something valuable too — documents, contact lists, and internal records that can be weaponized in follow-up phishing attacks.
On-Chain Evidence vs. Off-Chain Reality
There is an important distinction everyday investors should understand here. A breach of an internal communication system is not the same as a drain of exchange wallets. Bithumb’s statement that the trading system is separated matters because exchange hacks historically fall into two very different categories:
- Asset theft — hackers reach the wallets and steal coins directly. This is the nightmare scenario, and Bithumb says it did not happen here.
- Data exposure — hackers reach personal information such as names, phone numbers or email addresses. This appears to be the risk Bithumb is still investigating.
Even a “harmless” data leak is not harmless. Leaked customer details are the raw material for targeted phishing: fake “Bithumb security alert” emails and texts designed to trick you into handing over your password or one-time code. That is the real-world risk an altcoin holder on the exchange faces in the coming weeks.
The Core Conflict: Korea’s Black October
The Bithumb incident did not happen in a vacuum. South Korea’s financial sector is weathering what local media have described as a wave of cyberattacks. During a meeting at the Financial Supervisory Service headquarters on Wednesday, Governor Lee Chan-jin said cyberattacks had hit 16 South Korean financial firms as of October 14, according to comments reported by Cointelegraph.
The Korea Times reports that asset manager Mirae Asset Global Investments and brokerage Daishin Securities were also recent victims. Daishin disclosed that personal and credit information belonging to 38,490 customers had been leaked. Mirae Asset said it blocked abnormal external access to some web systems and that investor information was not affected, according to Yonhap.
For a crypto exchange preparing for a hoped-for public listing — Bithumb has set a 2028 IPO timetable while overhauling its internal controls — a breach of any kind lands at the worst possible time. Regulators, auditors and prospective institutional investors will all ask the same question: if the internal network was reachable, what else was?
Market Implications: What This Means for You
For regular investors, the practical takeaway is not panic — it is hygiene. Based on what Bithumb has said so far, coins on the exchange were not touched. But the possibility of leaked member information means every Bithumb user should assume their contact details could end up in a scammer’s database, even if the investigation ultimately finds no leak.
- Expect phishing attempts — treat any “urgent Bithumb” email, text or call as guilty until proven innocent.
- Never share codes — no legitimate Bithumb employee will ask for your password or two-factor code, ever.
- Consider a hardware key or authenticator app — stronger two-factor authentication defeats stolen passwords.
- Watch for the official announcement — Bithumb said one was coming; verify news directly on the exchange’s official channels, not through links in messages.
For the broader altcoin market, the episode is a reminder that in Korea — one of the world’s most active retail crypto markets — exchange trust is fragile. A serious escalation, such as confirmation of a large member-data leak, could dent trading activity on Korean platforms and the Kimchi premium sentiment that often accompanies it.
The Verdict
Bithumb caught the breach fast, reported it to regulators the same day, and drew a clear line between its staff systems and customer funds. That is the right playbook. But the investigation into whether member data leaked is still open, and the exchange now operates under the shadow of a national wave of attacks on financial firms. If you hold altcoins on Bithumb, your coins appear safe today — your personal information is the open question. Tighten your account security now, before scammers have a chance to use whatever the hackers found.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
Notified KISA and PIPC same day, frozen deposits on affected accounts, no hot wallet touch. Compare that to the 2019 raid incident handling and the improvement is obvious
everyone repeating ‘coins are safe’ but the real risk here is the phishing wave that follows. staff contact lists and internal records leaked means targeted attacks on users within weeks. happened after basically every big exchange breach
the fake sms wave is already real, my coworker got one an hour ago quoting her actual account tier. that data is definitely in whatever they pulled
^ exactly. internal chat apps have partner contacts, workflow docs, everything a social engineer dreams of. ‘separated from trading system’ wont stop a convincing fake email to a tired employee at 2am
employee comms server compromised and they still dont know what was accessed. at least they admitted it in writing instead of waiting for yonhap to squeeze it out of them
honestly the transparent part surprises me. past incidents at korean exchanges got buried for days before anyone confirmed anything
same feeling, but yonhap cited industry sources before bithumb said a word. transparent after a reporter calls is a lower bar than it sounds
already got a fake bithumb security alert text this evening lol. if your coins are fine like they say, the phishing wave is the real threat now
they notified KISA and the PIPC the same day they found it. credit where due, that is faster than most korean companies move. Bithumb learned the hard way from 2019
KISA and PIPC the same day is genuinely fast for Korea. Keep that pace for every incident since 2019 and maybe the market stops panic selling the first headline
moved off bithumb to self custody back in 2021 after their last ‘incident’. zero regrets, not doing this stress cycle again
fair, but self custody only saves your keys. if your kyc docs and phone number leaked in 2021 or now, you are still a phishing target forever