Bithumb Hacked as Personal Data Leaks in Korea Breach Wave

Published October 28, 2026, 07:20 AM PKT. Based on a Reuters report via Yonhap News Agency (primary source) and Aju Press reporting (secondary source), both published October 28, 2026.

South Korean crypto exchange Bithumb said its in-house mobile system was hacked and personal information leaked, Yonhap News Agency reported on October 28, 2026, making the exchange the latest financial firm to disclose a breach in a wave that has swept South Korea's financial sector through October. Bithumb said it was investigating whether member data was included, according to the report, and spokespeople for Bithumb, Daishin Securities and Mirae Asset could not immediately be reached for comment. The disclosures arrived the same day as two other financial firms confirmed their own incidents, and they extend a breach count that stood at 16 firms and roughly 100,000 exposed records when regulators last tallied it on October 14.

Bithumb says its internal mobile system was hacked

According to Yonhap, Bithumb said its in-house mobile system had been hacked and personal information leaked, and it was investigating whether member data was included. That wording leaves the most important question for the exchange's customers unanswered for now: whether the leaked information belongs to Bithumb members, and if so, how many. No report so far has described stolen customer funds, a trading halt, or a disruption to deposits and withdrawals at Bithumb, and readers should treat the absence of such a report as exactly that, an absence, not a confirmation that trading systems were untouched. Bithumb is one of South Korea's largest crypto exchanges, so even a breach confined to an internal mobile system carries weight for the country's crypto users, who have watched exchange security become a recurring national story this month.

The Bithumb disclosure is a new development in a wave MABOnChain has tracked since October 15, when South Korea's Financial Services Commission (FSC) said incidents had been identified at 16 financial firms, including a crypto exchange operator, and announced a cybersecurity overhaul for finance companies. The October 28 disclosures push the known firm count to at least 19, counting Bithumb, Daishin Securities and Mirae Asset alongside the earlier 16, and they show the wave is still growing two weeks after regulators first intervened.

Daishin confirms 38,490 customers exposed

Brokerage Daishin Securities gave the fullest account of the three new disclosures. Reuters reported that about 38,000 pieces of customer information had been leaked and that the firm had taken emergency measures, while Aju Press put the customer count at 38,490. Daishin said it first detected signs of unauthorized access on October 17 to a server supporting remote securities account opening for discretionary investment services, according to Aju Press, and it blocked the internet addresses used in the attack, including those used to bypass access restrictions, and notified regulators. Working with the Financial Security Institute, the brokerage reviewed about 60,000 requests disguised as legitimate service traffic over a 10 day investigation and confirmed the information leak on October 26.

Eight categories of information were exposed, according to Aju Press: customer names, email addresses, postal addresses, communications IDs, bank names, bank account numbers, Daishin securities account numbers and mobile phone numbers. The bank and securities account numbers and mobile phone numbers were encrypted, the company said. Daishin said it had found no evidence so far of secondary harm or unauthorized access to its core business systems, and it began notifying affected customers individually on October 28, pledging compensation under applicable laws and procedures for losses caused by the breach. "We take this leak of personal and credit information very seriously and deeply apologize to our customers," Chief Executive Jin Seung-wook said, adding that the company would responsibly carry out the measures necessary to protect customers and prevent a recurrence. The brokerage also promised tighter access controls, stronger detection and blocking of suspicious activity, and security checks on systems connected to outside services.

Mirae Asset incidents and a growing Kookmin count

Asset manager Mirae Asset Global Investments also confirmed a hacking incident, according to Yonhap, with authorities assessing the situation. The report gave no customer count and no detail on what information, if any, was exposed, and that gap is itself part of the story: two of the three October 28 disclosures arrived with almost no detail beyond confirmation. Separately, Aju Press reported that Mirae Asset Life Insurance confirmed a customer credit information leak on October 26 after detecting suspicious activity the previous day, affecting parts of its insurance application system and website, with the number of affected customers and the precise information exposed still under investigation.

Earlier cases are also proving more extensive than first reported. KB Kookmin Bank said on October 26 that the number of people affected by its previously disclosed breach had risen to 2,210 from 119, according to Aju Press. A further review identified 2,091 additional people, including 1,631 customers and 460 current or former employees, and the exposed information included account numbers, deposit balances, loan records and credit ratings, varying by individual. The bank said the revision reflected further findings from the original incident, a pattern that should make readers cautious about treating any of today's counts as final.

Regulators widen the net as a PHP flaw warning goes out

The FSC's October 14 tally, 16 firms and roughly 100,000 records exposed, was already described as an interim count before the latest disclosures, and investigators were still examining whether the attacks were connected, according to Aju Press. An industrywide review of 555 firms found shortcomings at 130, including missing security updates, inadequate monitoring and weaknesses in authentication and access controls, the FSC said, and authorities are pursuing broader inspections and stronger accountability for senior management. Separately, Seoul's Science Ministry and the Korea Internet and Security Agency urged website operators to check for PHP flaws that let attackers run malicious commands on a server without logging in, a warning that points to one possible attack route but does not, on its own, establish how any of the three October 28 incidents happened.

What is still unknown, and what to watch

Three questions remain open. First, whether Bithumb member data was included in the leak, and how many people are affected. Second, what information Mirae Asset's incident exposed, and whether its asset management arm and its life insurance arm suffered the same intrusion or two separate ones. Third, whether investigators will link the October 28 incidents to the earlier wave, or treat them as separate attacks riding the same month of heightened activity. What to watch next is concrete: Bithumb's own statement clarifying the member data question, Daishin's customer notifications and any secondary harm reports, and the FSC's updated firm and record counts. Until Bithumb answers the member data question, its customers should assume their personal information could be involved and watch for phishing messages that exploit the breach, a standard risk after personal data leaks even when no funds are reported stolen.

This article is news reporting and is not investment advice.

Sources

• Reuters via Yonhap News Agency, Three South Korean financial firms including Bithumb report data breaches, Yonhap says (October 28, 2026), primary source
• Aju Press, Korea's hacking spreads to brokerages and crypto (October 28, 2026), secondary source
• MABOnChain, South Korea Says Crypto Exchange Operator Hacked as 16 Financial Firms Hit (October 15, 2026), secondary source