PEPE

Time

Treat

<div style="margin: 28px 0; padding: 18px 22px; border: 1px solid rgba(56,189,248,0.5); border-radius: 10px; border-left: 6px solid #38bdf8;">
 <p style="margin: 0 0 10px; font-size: 13px; font-weight: bold; letter-spacing: 1px; text-transform: uppercase; color: #38bdf8;">Key Takeaways</p>
 <ul style="margin: 0; padding-left: 20px;">
  <li style="margin-bottom: 6px;">Breach found October 27 in staff groupware</li>
  <li style="margin-bottom: 6px;">So far mainly employee information appears exposed</li>
  <li style="margin-bottom: 6px;">Bithumb’s 2017 leak also began on staff hardware</li>
  <li>Affected users must be told within 72 hours</li>
 </ul>
</div>
<p>Bithumb discovered unauthorized access to its internal mobile groupware on October 27 and reported it to the Korea Internet &amp; Security Agency and the Personal Information Protection Commission the same day, <a href="https://www.yna.co.kr/view/AKR20261028043952002" rel="noopener noreferrer nofollow">Yonhap reported</a>.</p>
<h2 id="what-the-attackers-reached">What the attackers reached</h2>
<p>The breached tool is Daou Office, a workplace app Bithumb staff use for messaging and file sharing, <a href="https://www.news1.kr/finance/blockchain-fintech/6334377" rel="noopener noreferrer nofollow">News1 reported</a>. Bithumb told the outlet that its trading services run on a physically separate network and that no cryptocurrency was stolen. That matches the controls it described in an <a href="https://feed.bithumb.com/notice/1655182" rel="noopener noreferrer nofollow">October 2 security notice</a>: cold-wallet storage and approval steps for moving customer assets, plus limits and access logging for staff handling personal information.</p>
<p>The open question is what sat inside the app. According to <a href="https://www.digitaltoday.co.kr/en/view/120484/daishin-securities-bithumb-mirae-asset-hacked-security-alert-for-financial-investment-industry" rel="noopener noreferrer nofollow">Digital Today</a>, the information exposed so far relates mainly to employees, but Bithumb has not ruled out member data. Staff chats and shared files can pick up customer details during everyday support work, which is why the review covers messages and documents rather than only the main customer database. In a statement quoted by <a href="https://www.fnnews.com/news/202610280924154659" rel="noopener noreferrer nofollow">Financial News</a>, translated from Korean, the exchange said:</p>
<blockquote>
 <p>“We are analyzing the exact scope, including the possibility that member information was included.”</p>
</blockquote>
<p>Bithumb has not said how many people, if any, are affected, which fields were exposed, or how the attackers got in.</p>
<h2 id="the-38-490-figure-is-not-bithumb-s">The 38,490 figure is not Bithumb’s</h2>
<p>Bithumb disclosed its breach on the same day as two other Korean financial firms, and at least one crypto news site has since reported that Bithumb’s breach affected 38,490 customers. That number belongs to Daishin Securities. <a href="https://www.koreatimes.co.kr/business/banking-finance/20261028/bithumb-mirae-asset-daishin-join-growing-list-of-cyberattack-victims" rel="noopener noreferrer nofollow">The Korea Times reported</a> that Daishin confirmed a leak of personal and credit information for 38,490 customers after unauthorized access to a server linked to online account openings, while Mirae Asset Global Investments was also hit.</p>
<p>Daishin’s disclosure shows what a confirmed notice looks like. Digital Today reported that its review found eight types of data leaked, including names, email and home addresses, phone numbers, bank names and account numbers. Bithumb has not yet published anything comparable. There is also no public finding that the three incidents share an attacker or entry point.</p>
<div class="read-more pb-3 pt-3 pt-md-2 px-3 my-4 border bg-light">
 <h5 class="text-uppercase border-bottom mb-3 pb-1 d-none d-md-block">READ MORE:</h5><a href="https://coindoo.com/pepe-price-jumps-other-memecoins-doing/" rel="noopener noreferrer nofollow">
  <div class="contentRight col-4"><span><img src="https://coindoo.com/wp-content/uploads/2025/03/pepecoin.jpeg"></span>
  </div>
  <div class="contentLeft col-8">
   <h4 class="title mb-0">PEPE Price Jumps 12%: Which Memecoins Kept Pace?</h4>
  </div></a>
</div>
<h2 id="bithumb-has-been-here-before">Bithumb has been here before</h2>
<p>In 2017, an attacker compromised a Bithumb employee’s home computer and took the names, email addresses and mobile numbers of about 31,800 users, according to <a href="https://thehackernews.com/2017/07/bitcoin-ethereum-cryptocurrency-exchange.html" rel="noopener noreferrer nofollow">reports at the time</a>. No passwords were taken, and Bithumb stressed that its head-office servers were not breached.</p>
<p>The damage came afterwards. Customers began receiving calls and messages from people posing as Bithumb staff who already knew their names and numbers, and some were talked into sharing the one-time passwords that protected their accounts. More than 100 customers filed complaints with the police cybercrime unit, and Bithumb offered 100,000 won to every affected user plus reimbursement of proven losses.</p>
<p>The 2026 breach is a different system and, so far, a different scope. But the pattern is the one to watch. The risk from a data leak at an exchange usually arrives later, through a phone call that sounds real because the caller knows real details. Similar concerns followed <a href="https://coindoo.com/israeli-crypto-broker-bits-of-gold-warns-customers-after-a-data-breach/" rel="noopener noreferrer nofollow">a customer-data breach at Israeli broker Bits of Gold</a>.</p>
<h2 id="the-warning-bithumb-issued-two-weeks-earlier">The warning Bithumb issued two weeks earlier</h2>
<p>On October 14, before this incident, Bithumb published <a href="https://feed.bithumb.com/notice/1655252" rel="noopener noreferrer nofollow">guidance on scams that use leaked personal information</a>. It warned that a name, contact details and knowledge of the services someone uses can make a fraudulent message look legitimate, and described approaches built around fake compensation offers, identity checks and account-security reviews. Those are exactly the lines a scammer would try on worried customers this week.</p>
<div style="margin: 26px 0; padding: 18px 22px; border: 1px solid rgba(248,113,113,0.5); border-radius: 10px;">
 <p style="margin: 0 0 10px; font-weight: bold; color: #f87171;">What Bithumb customers can do now</p>
 <ul style="margin: 0; padding-left: 20px;">
  <li style="margin-bottom: 6px;">Treat any call, text or email about the breach as unverified until you check it in the Bithumb app or website you normally use.</li>
  <li style="margin-bottom: 6px;">Never share a password, one-time code or verification number with anyone who contacts you, whatever details they already know.</li>
  <li style="margin-bottom: 6px;">Ignore “compensation” offers that ask you to log in through a link or move funds.</li>
  <li>Watch Bithumb’s official notice board for a notification that names the data involved.</li>
 </ul>
</div>
<h2 id="when-customers-should-hear-more">When customers should hear more</h2>
<p>Korea’s Personal Information Protection Act sets a deadline. Once a company becomes aware that personal information has been leaked, it must <a href="https://law.asia/doing-business-in-korea-data-privacy-compliance" rel="noopener noreferrer nofollow">notify the affected people within 72 hours</a>, including steps they can take to limit harm, and report to the PIPC or KISA within the same window if 1,000 or more people are affected or the leak involved illegal outside access.</p>
<p>Bithumb has already reported the intrusion to both agencies. If its review confirms that customer data was exposed, the 72-hour clock for notifying those customers starts from that finding. A useful notice would say which data fields were in the app, which period the exposure covers, and how Bithumb will contact affected users, so customers can tell a genuine message from the scams its own guidance warned about.</p>
<p style="text-align: center;"><em>This article is provided for informational purposes only. The scope of the incident remains under investigation, and findings may change as Bithumb and authorities provide further information.</em></p>
<p>The post <a href="https://coindoo.com/bithumb-hacked-again-this-time-through-a-staff-app/" rel="noopener noreferrer nofollow">Bithumb Hacked Again – This Time Through a Staff App</a> appeared first on <a href="https://coindoo.com" rel="noopener noreferrer nofollow">Coindoo</a>.</p>

Bithumb Hacked Again – This Time Through a Staff App

Table of Contents

Coindoo.com

Other articles published on Oct 28, 2026

Join our free newsletter for daily crypto updates!