Bithumb and Two Financial Firms Hit by Cyber Intrusions
South Korean financial institutions face data breaches targeting internal systems and customer records.
1Unauthorized Groupware Access
Bithumb, the second-largest crypto exchange in South Korea, confirmed an unauthorized external party accessed its internal mobile groupware system on October 27, 2026. This collaboration software, used for messaging and document approvals, potentially exposed internal staff details and sensitive communications. The exchange is currently investigating whether specific customer data was compromised.
2Broader Financial Sector Impact
The breach was not isolated to Bithumb, as two other major South Korean financial institutions reported simultaneous cyber intrusions. Daishin Securities disclosed that personal and credit information for 38,490 customers was leaked. Meanwhile, Mirae Asset Global Investments confirmed a hacking incident, though the firm has not yet detailed the total number of affected clients.
3Regulatory Investigation Underway
South Korea’s Financial Supervisory Service, the primary national financial watchdog, has launched a formal investigation into all three reported cases. While investigators are reviewing the incidents, they have not yet established a direct link between the Bithumb intrusion and the breaches at the other two financial firms, despite the timing of the events.
4Back-Office vs Wallet Security
Industry experts distinguish this incident from direct hot wallet hacks where attackers drain cryptocurrency assets. This breach targeted back-office systems, which, while not resulting in immediate fund theft, creates significant risks for targeted phishing or social engineering attacks against both employees and users. The long-term security implications for these platforms remain a concern.
5Rising Trend of System Infiltration
The financial sector is witnessing a surge in back-office system targeting, mirroring recent breaches at Foundation and GMO, where 26,739 servers were put at risk. These incidents highlight a shift in attacker methodology, moving away from direct asset theft toward the acquisition of sensitive customer data and internal infrastructure control for future exploitation.
6Bithumb's Turbulent 2026 History
This security incident adds to a challenging year for Bithumb, which previously faced a major operational error in February 2026. During a promotional event, the exchange mistakenly credited 620,000 BTC to 249 users. Although the firm recovered 99.7% of the funds, the event required significant compensatory efforts and internal process adjustments for the exchange.
7Regional Vulnerability and Context
South Korean exchanges have historically been frequent targets for sophisticated cyberattacks. For instance, rival exchange Upbit suffered a $36 million Solana network hot wallet hack in November 2025, which authorities linked to the Lazarus Group. These repeated incidents underscore the persistent security threats facing the nation's digital asset and financial infrastructure providers.
8Regulatory and Tax Uncertainty
These breaches occur while Seoul struggles to finalize its comprehensive cryptocurrency rulebook. The government is reportedly preparing to delay its cryptocurrency gains tax for a fourth time, reflecting ongoing legislative uncertainty. This regulatory environment complicates the operational landscape for exchanges already managing the immediate fallout from these high-profile cybersecurity failures and data leaks.
Original article: Bitcoin News — Bithumb and Two Financial Firms Hit by Cyber Intrusions