Bithumb Says Hackers Accessed Internal System, Leaking Personal Data

What it is

On 28 October 2026 (Wednesday, local time), Bithumb said an unauthorized outside party had accessed its internal mobile groupware system and leaked personal information, according to Yonhap News Agency. The exchange is still investigating whether customer data was exposed. An industry source told Yonhap that some Bithumb customer information did leak. Bithumb has not said how its system was accessed.

Two other South Korean firms reported breaches the same day. Daishin Securities said it detected signs of unauthorized access last week, and that 38,490 customers' names, email addresses and mobile numbers leaked. It said it would compensate customers for resulting damage as the law requires. Mirae Asset Global Investments confirmed a hacking incident, and financial authorities have begun an inspection.

Preconditions / Affected

The page names these as affected or at risk:

• Bithumb customers, scope unconfirmed.
• Daishin Securities customers, 38,490 people.
• Mirae Asset Global Investments, scope not stated.
• Coinbase customers whose contact data was exposed through the vendor Amplitude (Coinbase said funds were unaffected).

The Korean Financial Services Commission said earlier in October that attacks on 16 South Korean financial firms, including banks, had caused about 100,000 data leaks. The three new reports follow that wave.

What to do

South Korea's Science Ministry and the Korea Internet & Security Agency have urged website operators to check for recently disclosed PHP flaws that let attackers run commands on a server without logging in. The page gives no CVE ids, versions or patch steps for these flaws. Operators of PHP-based sites in Korea should look for the agency advisory itself.

Changpeng Zhao, Binance's founder, advised users to:

• Sign up to each exchange with a unique email alias.
• Avoid SMS-based two-factor authentication.
• Ask their phone carrier for a number lock.

He said leaked exchange data is mostly used for phishing, SIM swapping and social engineering. He added that leaked addresses and holdings data "have led to real-world extortion and robberies."

Caveats

The page does not link the PHP advisory to any of these breaches. It states only that Bithumb has not said how its system was accessed. Spokespeople for the three Korean firms could not be reached for comment by Reuters.