Hundreds of Bithumb Customer Records Leaked in Hack

Published October 29, 2026, 2:37 PM PKT. Based on Yonhap News Agency reporting published October 29, 2026, Seoul Economic Daily reporting published October 29, 2026, and Cointelegraph and Reuters reporting published October 28, 2026 (primary and secondary sources below). This is a follow-up to MABOnChain's October 28 article on the Bithumb breach, which left the customer-data question unanswered.

Personal information of hundreds of customers at South Korean crypto exchange Bithumb leaked in its recent internal system hack, industry sources told Yonhap News Agency on October 29, 2026, according to Yonhap's English-language service. The finding changes the picture from October 28, when Bithumb's breach was first reported and the leak was initially believed to have affected only employees. Bithumb reported the data breach in its in-house mobile system on October 28, but after analyzing the scope of the leak it found that customer information had also been exposed, Yonhap reported. No report so far has described stolen customer funds, a trading halt, or a disruption to deposits and withdrawals at Bithumb.

Hundreds of customer records confirmed leaked

Yonhap's October 29 report is specific about what changed, and careful about what it does not prove. "Personal information of hundreds of customers at cryptocurrency exchange Bithumb has been leaked in a recent cyberattack, industry sources said Thursday," Yonhap wrote. "Bithumb reported a data breach in its in-house mobile system on Wednesday, but the incident was initially believed to have affected only its employees. After analyzing the scope of the data leak, Bithumb found that personal information of hundreds of customers has also been exposed, according to the sources." The confirmation comes from industry sources speaking to Yonhap, not from a Bithumb statement giving its own count, and readers should hold that distinction in mind.

Seoul Economic Daily, reporting the same finding on October 29, put it in plainer terms: hundreds of customer records were leaked along with employee information in the Bithumb hack that occurred on the 27th, and the investigation later found that customer information had also been taken outside the company. The paper added a second important qualifier: Bithumb has yet to issue an official notice on the exact scale of the leak or the categories of data involved. That means the public still does not know how many hundreds of customers are affected, which fields were exposed, or whether Bithumb will notify affected customers individually, as brokerage Daishin Securities did for its own breach.

How customer data reached an employee system

The breach hit Bithumb's internal mobile groupware system, the platform employees use for work communications and file sharing, after an unauthorized outside party gained abnormal access on October 27, according to Yonhap and Seoul Economic Daily. Bithumb discovered the intrusion on October 27 and notified the Korea Internet and Security Agency and the Personal Information Protection Commission the same day, Yonhap reported. Bithumb has said the internal work system is separated from its virtual asset trading system, so customer crypto assets cannot be accessed through this breach, a point Cointelegraph also reported on October 28.

The new finding does not contradict that separation, but it does show its limits. Seoul Economic Daily reported that messages and shared files exchanged among employees may have contained customer information, which is how a system that never touches trading could still expose customer records. That explanation is plausible, not proven: neither Yonhap nor Seoul Economic Daily has published the mechanism by which customer data entered the groupware system, or which employee files contained it. Until Bithumb publishes its own account, the route from an internal work tool to hundreds of customer records remains an open question, and no report has identified the attacker or the intrusion method.

Disclosure scrutiny and the regulator response

Bithumb's handling of the incident is now under scrutiny alongside the breach itself. Seoul Economic Daily reported that the company recognized the intrusion on the 27th but had not issued a separate notice to users as of the following day, and that both the breach itself and the scale of the customer data leak were reported in the media before Bithumb disclosed them. That timeline matters because the October 28 coverage, including MABOnChain's article, could only report that member data involvement was unconfirmed. The October 29 confirmation arrived through Yonhap's industry sources, not through a Bithumb update correcting the record.

Regulators moved before the customer confirmation. South Korea's Financial Services Commission said in an October 28 notice that the information involved employees of Bithumb, its subsidiaries and partner companies, and it began on-site inspections with the Financial Supervisory Service and the Financial Security Institute, according to reporting on the FSC notice. The FSC said it planned to oversee protection measures, including full compensation, if consumers suffer damage. Financial Supervisory Service Governor Lee Chan-jin had already told a meeting on October 28 that cyberattacks had hit 16 South Korean financial firms as of October 14, according to Cointelegraph, a count that predates the Bithumb customer confirmation and will need updating.

The wider Korean breach wave, in numbers

Bithumb was one of three South Korean financial firms to report breaches on October 28, and the other two cases show how much detail is still missing from Bithumb's account. Brokerage Daishin Securities said personal information of 38,490 customers leaked, including names, email addresses and mobile phone numbers, after detecting signs of unauthorized access, Reuters reported via Yonhap on October 28. Asset manager Mirae Asset Global Investments confirmed a hacking incident the same day, with authorities assessing the situation and no customer count published. Smaller exchange Prabang, also known as Prabank, separately reported about 100 million won in customer asset losses from an October 24 hot wallet incident, and said it would fully compensate affected funds from company assets.

The practical risk from a customer data leak is phishing, not direct theft from the exchange. Binance founder Changpeng Zhao, listing the Bithumb, Coinbase vendor, Daishin and Mirae Asset incidents on October 28, warned that leaked exchange data is mostly used for phishing, SIM swapping and social engineering, Decrypt reported. That warning applies directly to the newly confirmed Bithumb customer records: anyone contacting a Bithumb customer about an account problem, a security issue or a refund should be treated as suspect, especially if the caller already knows the customer's name or account details, since that knowledge may now come from the leak rather than from the exchange.

What is still unknown, and what to watch

Four questions remain open, and Bithumb's next statement will be judged against them. First, the exact number of affected customers, beyond "hundreds." Second, the categories of customer data exposed, which Seoul Economic Daily says Bithumb has not disclosed. Third, whether affected customers will be notified individually and offered protection or compensation, as Daishin has done. Fourth, what the FSC and Financial Supervisory Service on-site inspections find about how customer data reached an employee system, and whether any other firm in the October wave has a similar gap. Until those answers arrive, the confirmed facts are narrow: an October 27 intrusion into Bithumb's internal mobile groupware system leaked employee data and, as confirmed October 29, personal information of hundreds of customers, with no customer funds reported stolen and no official Bithumb notice yet on scale or data categories.

This article is news reporting and is not investment advice.

Sources

• Yonhap News Agency via K-VIBE, Hundreds of customers' personal information at Bithumb leaked in hacks (October 29, 2026), primary source for the hundreds of customers confirmed exposed and the initial employees-only belief
• Seoul Economic Daily, Bithumb Hack Also Leaked Hundreds of Customer Records (October 29, 2026), secondary source for the October 27 intrusion date, the employee file explanation, the absence of an official notice on scale and categories, and the disclosure scrutiny
• Cointelegraph, Bithumb Investigates Extent of Data Leak After Internal Hack (October 28, 2026), secondary source for the October 27 discovery, the KISA and Personal Information Protection Commission notifications, and the trading system separation
• MABOnChain, Bithumb Internal Mobile System Hacked as Personal Data Leaks in South Korea's Widening Breach Wave (October 28, 2026), secondary source for the original unconfirmed member data question and the Daishin 38,490 figure