Key Highlights
- Bithumb confirmed a data breach after unauthorized access to its internal mobile groupware system, operated through the third-party platform Daou Office.
- However, Bithumb stated that customer virtual assets remain unaffected and no abnormal withdrawals were detected.
- The incident is part of a latest wave of cyberattacks on South Korean financial firms, with Daishin Securities reporting leaked data on 38,490 customers and Mirae Asset Global Investments also confirming unauthorized access, following attacks on 16 firms earlier in October.
On Wednesday, South Korea’s second-largest cryptocurrency exchange, Bithumb, confirmed a data breach after unauthorized access to its internal mobile groupware system. The incident is the latest addition to the series of cyberattacks targeting the country’s financial sector this month.
Bithumb detected the intrusion on Tuesday. The compromised system, operated through a third-party platform known as Daou Office, is used by employees for internal messaging, scheduling, and documents. It is physically separated from the exchange’s trading network and customer-facing systems.
Bithumb Ensures the Safety of Users’ Funds
According to a local news report, Bithumb stated that customer virtual assets remain unaffected and no abnormal withdrawals have been identified. Bithumb is investigating whether any member or customer personal information was exposed and has reported the matter to the Korea Internet & Security Agency and the Personal Information Protection Commission.
Bithumb said personal information was leaked from the internal system. Officials are analyzing the exact scope and timing of the access. Bithumb emphasized that the groupware platform has no connection to trading operations or asset storage. Financial Supervisory Service inspectors are assessing the situation alongside other recent cases.
Daishin Securities and Mirae Asset Global Investments Report Breaches Today
Daishin Securities reported that personal and credit information belonging to 38,490 customers was leaked. The brokerage detected unauthorized access on October 17 to a server linked to online account openings for discretionary investment services. Exposed data included names, email addresses, physical addresses, bank account numbers, and mobile phone numbers. Daishin has taken emergency measures, notified affected customers, and said it will compensate for any resulting damage.
Mirae Asset Global Investments also confirmed a hacking incident involving unauthorized external access to some of its online or business-use systems. The firm stated that no general customer information or financial damage has been identified so far. It blocked the access routes and launched an emergency response.
These three cases follow a wave of attacks that hit 16 South Korean financial firms earlier in October, including banks, causing around 100,000 cases of data leaks according to the Financial Services Commission. Financial Supervisory Service Governor Lee Chan-jin urged the sector to strengthen IT security against sophisticated, including AI-assisted, attacks during a meeting with bank holding company board chairs.
Cryptocurrency Sector Faces Fresh Wave of Cyber Attacks
Cryptocurrency platforms, such as Bitget and related services, have faced repeated targeting in recent months. Indian exchange CoinDCX confirmed a roughly $16 million loss in late October 2026 after funds were drained from retired wallets linked to a larger July 2025 incident that cost about $44 million. The company said it absorbed the latest loss, stressed that active customer funds and systems were not affected, and credited affected users.
Hardware wallet maker Ledger has also been in the spotlight. In early October 2026, devices sold through a Southeast Asian reseller were found to contain unauthorized hardware implants that captured recovery phrases during setup and transmitted them. On-chain estimates put related thefts in the range of $90 million to over $100 million across multiple blockchains. Ledger confirmed the implants were limited to devices from that reseller channel and that its own systems and direct sales were not compromised.
South Korean authorities have dispatched inspectors and are examining the latest incidents. Officials have also warned website operators about PHP vulnerabilities that can allow attackers to run commands without logging in. The pattern of breaches across banks, brokerages, asset managers, and crypto platforms highlights ongoing challenges in securing financial and digital asset infrastructure as attackers grow more sophisticated.
Bithumb and other firms like Keystone continue their internal probes and customer notifications. No evidence of fund theft from the current Bithumb incident has been reported. Users of affected platforms have been advised to monitor accounts and follow official guidance from the companies and regulators.
