Bithumb Breach Exposes Employee Data via Daou Office Platform

Bithumb reported a breach of its internal employee mobile groupware system on October 27, 2026. The incident involved a third-party platform called Daou Office and primarily affected employee personal information such as names, work emails, and mobile numbers. Regulators received notification the same day.

Bithumb Breach Details and Technical Scope

The compromised system operated separately from Bithumb trading platforms and customer asset storage. No cryptocurrency was stolen and no abnormal withdrawals occurred. Bithumb stated that the employee system maintains physical and network separation from exchange operations, which prevented access to virtual assets held by customers. Service disruptions did not take place.

Investigators continue to determine whether customer data appeared in chats or shared files on the platform. Bithumb has not released confirmed figures for the number of affected records or the precise categories of data that left the system. The exchange notified the Korea Internet & Security Agency and the Personal Information Protection Commission immediately after discovery.

Internal reviews remain underway to establish the exact timing and full extent of access. Bithumb emphasized that the groupware platform serves only employees and holds no direct connection to the main trading infrastructure.

Wave of Cyberattacks on South Korean Financial Firms

The Bithumb incident forms part of a broader series of cyberattacks targeting South Korean financial institutions during October 2026. On the same day, Daishin Securities confirmed a breach that exposed personal and credit data of 38,490 customers. Mirae Asset Global Investments reported suspicious external IP activity on its web systems, though investor information remained unaffected.

Earlier in the month, cyberattacks struck 16 financial firms and produced roughly 100,000 data-leak cases. Authorities including the Financial Supervisory Service, Financial Services Commission, and Financial Security Institute launched on-site inspections and convened an emergency meeting focused on virtual asset cybersecurity. FSS Governor Lee Chan-jin described cybersecurity as a core board-level responsibility given rising AI-assisted threats.

Bithumb ranks as South Korea’s second-largest crypto exchange by trading volume. Separate reports have noted increased scanning activity linked to North Korean actors and prior operations by AI-powered hacking groups, though investigators have not connected those activities directly to the October incidents.

Regulatory Actions and Ongoing Monitoring

Regulators have begun information-sharing protocols and victim-protection measures that may include compensation processes. Affected individuals will receive formal notification under existing timelines, including a 72-hour window in certain regulatory contexts. Bithumb plans additional public updates once verification concludes.

Daishin Securities stated it will provide compensation according to applicable law if damage occurs. Financial authorities continue to monitor for secondary damage and require strengthened defensive measures across the sector. Bithumb will supply further details as the internal investigation produces verified findings.