Security

Life

Daily

Wednesday

Data breaches at Bithumb, Daishin Securities and Mirae Asset Global Investments have triggered a preliminary investigation by South Korea’s National Police Agency.
The police agency investigators are looking into the extent of stolen data in the latest breach and checking whether it is connected to an earlier wave of AI-assisted attacks that hit 16 financial firms in the country.
<h3 id="span-style-font-weight-400-which-south-korean-companies-were-hacked-span">Which South Korean companies were hacked?</h3>
Daishin Securities, Bithumb and Mirae Asset Global Investments were the latest firms to be hit in a wave of breaches concentrating in South Korea. The same team at the National Office already working on the bank hacks reported earlier has taken over the Investigation of the newest incidents as of Wednesday morning.
Daishin Securities was the hardest hit, per local reports, with the personal and credit data of 38,490 customers exposed.
So far, Bithumb has confirmed that attackers accessed staff data. The exchange is still assessing whether member information was also stolen.
Information from Mirae Asset Global Investments’ internal business systems was exposed. However, the firm’s statement reported no evidence that personal credit data was taken.
The numbers from the three new incidents, when fully confirmed, will add to roughly 100,000 records <a href="https://eiec.kdi.re.kr/policy/materialView.do?num=288099" rel="noopener noreferrer nofollow">exposed at 16 financial companies</a> as of October 14.
<h3 id="span-style-font-weight-400-are-the-south-korean-hacks-connected-span">Are the South Korean hacks connected?</h3>
While no link has been confirmed, investigators from the South Korean National Police Agency are <a href="https://www.yna.co.kr/view/AKR20261028115900004" rel="noopener noreferrer nofollow">comparing methods</a> used in the recent breaches to identify matches and determine whether the attacks are isolated.
Local outlet <a href="https://en.sedaily.com/finance/2026/10/27/kb-bank-data-breach-victims-jump-to-2210-from-119" rel="noopener noreferrer nofollow">Seoul Economic Daily quoted</a> a police official as saying: “We are not ruling out the possibility that this was an attack by the same person behind the bank hacking case.”
If the investigators confirm a connection, it means the same attackers who used ARTEX to hit banks are behind these late-October breaches. ARTEX is a China-built open-source agentic penetration-testing tool that runs alongside large language models such as Claude Code.
<a href="https://www.cryptopolitan.com/ai-powered-attacks-hit-south-korean-banks/" rel="noopener noreferrer nofollow">Cryptopolitan reported</a> that CrowdStrike <a href="https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/" rel="noopener noreferrer nofollow">found the attacker’s own Claude Code session logs</a>, ARTEX configuration files and memory files sitting in exposed server directories.
CrowdStrike fingered a financially motivated, Chinese-speaking operator with moderate confidence, based on assessments of recovered files. Because the attacker used the same tools to draft a résumé, they leaked their own contact and Telegram details, which CrowdStrike said may belong to a 26-year-old in Maoming, Guangdong.
Notably, the security firm conceded that the identifiers are not 100% reliable.
South Korean specialists are skeptical of Chinese involvement simply on the basis that the tool is Chinese-built. A professor at Korea University’s Graduate School of Information Security questioned whether ARTEX was the only tool used in the attacks.
<h3 id="span-style-font-weight-400-victim-numbers-continue-to-grow-span">Victim numbers continue to grow</h3>
Earlier this week, KB Kookmin Bank said a detailed re-examination lifted its confirmed victim count from 119 to 2,210. Mirae Asset Life Insurance, a separate entity, also detected intrusions and drew an urgent on-site inspection from the Financial Supervisory Service.
The Financial Services Commission has already run a security review of 555 financial companies and found shortcomings at 130, including missing security patches and no real-time monitoring.
Bithumb, for its part, has been running a campaign warning customers that leaked personal data is being reused in follow-on phishing and remote-access scams.
If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.

Korean police probe Bithumb, Daishin hacks as AI-linked breach count keeps climbing

Table of Contents

Cryptopolitan_News

Other articles published on Oct 28, 2026

Join our free newsletter for daily crypto updates!