Bithumb Confirms Cyberattack Amid Breaches at Three South Korean Financial Firms

Bithumb, South Korea’s second-largest cryptocurrency exchange, has confirmed that an unauthorized outside party gained access to its internal mobile groupware system and that personal information was leaked. The disclosure places the exchange among three South Korean financial firms that have reported intrusions, raising fresh concerns about the security of systems used to support financial businesses.

According to Yonhap News Agency, Bithumb said the incident involved its internal mobile groupware platform. The company described the access as coming from an external unauthorized party. It did not, in the information available, identify the attacker, explain how the system was entered or disclose the full scope of the data exposure.

The exchange also did not publicly establish whether customer funds, trading systems or digital assets were affected. The confirmed disclosure instead centers on the compromise of personal data stored or handled through the groupware system. That distinction is significant for customers and regulators because an intrusion into an internal communications or administrative platform can expose sensitive information even when a company’s core trading infrastructure remains operational.

Mobile groupware systems are commonly used by businesses for internal communications, document sharing, approvals and access to workplace information through smartphones and other devices. Because such platforms can connect employees with corporate records and administrative tools, they may become a target for attackers seeking personal information or credentials. The precise role of Bithumb’s system, however, was not detailed in the report, and no conclusion has been provided about whether the compromised platform was connected to other critical exchange operations.

Bithumb’s acknowledgment comes as two other South Korean financial firms have also reported intrusions. The available account does not specify the names of those companies or provide details about the systems involved in their cases. It therefore remains unclear whether the three incidents are connected, whether they followed a similar pattern or whether they represent separate attacks.

The absence of those details leaves several important questions unresolved. Bithumb has not indicated how long the unauthorized access lasted, what categories of personal information were taken, how many people may have been affected or whether the stolen information has been published or used. The exchange’s statement, as reported, also does not say whether law-enforcement agencies or South Korean cybersecurity authorities are investigating the incident.

For affected individuals, the exposure of personal information can create risks beyond the immediate breach. Data obtained from an internal platform may be used in phishing attempts, impersonation schemes or efforts to obtain access to other accounts. Cryptocurrency users are frequently targeted by fraudulent messages that imitate exchanges, wallets or customer-support teams. A confirmed leak does not by itself show that such follow-up activity has occurred, but it can increase the importance of verifying communications and avoiding links or requests that appear to come from a financial service.

Bithumb’s position in South Korea’s cryptocurrency market makes the incident particularly sensitive. Exchanges hold or process large volumes of customer information and operate in an environment where users are already exposed to digital-asset scams and account-security threats. Even when an intrusion does not result in the loss of cryptocurrency, a personal-data breach can undermine customer confidence and prompt scrutiny of the company’s internal controls.

The reported breach also highlights the difference between operational continuity and information security. An exchange can continue processing trades while a separate internal system is investigated, but the continued availability of its services does not eliminate the consequences of a data leak. Companies must assess not only whether attackers can move funds, but also whether they can access employee records, customer information, internal documents or authentication details.

The incident is expected to put pressure on Bithumb to clarify its response. A complete account would typically address when the company discovered the intrusion, which systems were isolated, whether access credentials were reset and what steps were taken to prevent a recurrence. It would also help users understand whether they need to change passwords, strengthen account protections or be alert for suspicious messages.

At present, the publicly reported facts remain limited. Bithumb has confirmed unauthorized access to its internal mobile groupware system and the leakage of personal data, while two other South Korean financial firms have acknowledged intrusions. The identity of the attackers, the connection between the cases and the ultimate scale of the exposure have not been established. Further information from Bithumb, investigators or relevant authorities will be needed to determine the full impact of the breach.