Bithumb Hacked Again – This Time Through a Staff App

Bithumb discovered unauthorized access to its internal mobile groupware on October 27 and reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission the same day, Yonhap reported.

What the attackers reached

The breached tool is Daou Office, a workplace app Bithumb staff use for messaging and file sharing, News1 reported. Bithumb told the outlet that its trading services run on a physically separate network and that no cryptocurrency was stolen. That matches the controls it described in an October 2 security notice: cold-wallet storage and approval steps for moving customer assets, plus limits and access logging for staff handling personal information.

The open question is what sat inside the app. According to Digital Today, the information exposed so far relates mainly to employees, but Bithumb has not ruled out member data. Staff chats and shared files can pick up customer details during everyday support work, which is why the review covers messages and documents rather than only the main customer database. In a statement quoted by Financial News, translated from Korean, the exchange said:

“We are analyzing the exact scope, including the possibility that member information was included.”

Bithumb has not said how many people, if any, are affected, which fields were exposed, or how the attackers got in.

The 38,490 figure is not Bithumb’s

Bithumb disclosed its breach on the same day as two other Korean financial firms, and at least one crypto news site has since reported that Bithumb’s breach affected 38,490 customers. That number belongs to Daishin Securities. The Korea Times reported that Daishin confirmed a leak of personal and credit information for 38,490 customers after unauthorized access to a server linked to online account openings, while Mirae Asset Global Investments was also hit.

Daishin’s disclosure shows what a confirmed notice looks like. Digital Today reported that its review found eight types of data leaked, including names, email and home addresses, phone numbers, bank names and account numbers. Bithumb has not yet published anything comparable. There is also no public finding that the three incidents share an attacker or entry point.

READ MORE:

PEPE Price Jumps 12%: Which Memecoins Kept Pace?

Bithumb has been here before

In 2017, an attacker compromised a Bithumb employee’s home computer and took the names, email addresses and mobile numbers of about 31,800 users, according to reports at the time. No passwords were taken, and Bithumb stressed that its head-office servers were not breached.

The damage came afterwards. Customers began receiving calls and messages from people posing as Bithumb staff who already knew their names and numbers, and some were talked into sharing the one-time passwords that protected their accounts. More than 100 customers filed complaints with the police cybercrime unit, and Bithumb offered 100,000 won to every affected user plus reimbursement of proven losses.

The 2026 breach is a different system and, so far, a different scope. But the pattern is the one to watch. The risk from a data leak at an exchange usually arrives later, through a phone call that sounds real because the caller knows real details. Similar concerns followed a customer-data breach at Israeli broker Bits of Gold.

The warning Bithumb issued two weeks earlier

On October 14, before this incident, Bithumb published guidance on scams that use leaked personal information. It warned that a name, contact details and knowledge of the services someone uses can make a fraudulent message look legitimate, and described approaches built around fake compensation offers, identity checks and account-security reviews. Those are exactly the lines a scammer would try on worried customers this week.

When customers should hear more

Korea’s Personal Information Protection Act sets a deadline. Once a company becomes aware that personal information has been leaked, it must notify the affected people within 72 hours, including steps they can take to limit harm, and report to the PIPC or KISA within the same window if 1,000 or more people are affected or the leak involved illegal outside access.

Bithumb has already reported the intrusion to both agencies. If its review confirms that customer data was exposed, the 72-hour clock for notifying those customers starts from that finding. A useful notice would say which data fields were in the app, which period the exposure covers, and how Bithumb will contact affected users, so customers can tell a genuine message from the scams its own guidance warned about.

This article is provided for informational purposes only. The scope of the incident remains under investigation, and findings may change as Bithumb and authorities provide further information.

The post Bithumb Hacked Again – This Time Through a Staff App appeared first on Coindoo.