FSS investigates Bithumb data leak, Daishin, Mirae Asset after security incidents

The exposure of customer personal information at Bithumb, South Korea's second-largest cryptocurrency exchange, occurred on October 28 after an external, unauthorized entity gained access to one of the exchange's internal workplace tools.

This incident follows a sequence of comparable security breaches affecting both traditional financial institutions and entities within the cryptocurrency sector. Authorities in South Korea are actively investigating the situation, as the Financial Supervisory Service (FSS) is looking into the incidents involving Bithumb, Daishin Securities, and Mirae Asset Global Investment. The FSS dispatched an on-site team to Daishin Securities, which disclosed that data pertaining to over 38,000 of its clientele, including their phone numbers, emails, and names, was compromised.

Regarding Bithumb, the exchange itself confirmed that it identified unauthorized external access to its internal mobile groupware system on October 27, though the precise extent of the data compromise remains under determination. Furthermore, FSS Director Lee Chan-jin addressed the financial industry during a meeting with the chairmen of eight bank holding companies, emphasizing the growing threat landscape. He warned, "As artificial intelligence is used as a means of hacking, security vulnerabilities will be easily detected and simultaneous attacks will become a regular occurrence." He also stressed that corporate boards must now assume responsibility for enhancing their firms' security capacities.

Binance co-founder Changpeng Zhao (CZ) also issued guidance to his followers on X, advising that while preventing data leaks might be impossible, individuals can implement protective measures, such as limiting shared information and securing their accounts. He noted that the data stolen from exchanges frequently facilitates SIM-swapping and phishing schemes, and he strongly suggested employing a distinct email alias for every exchange, alongside utilizing hardware keys or passkeys instead of SMS verification codes. CZ cautioned users to always operate under the assumption that any contact claiming to be about an account, "security issues," or "refund recovery" is fraudulent, even if the contact possesses personal details like names, balances, or recent transaction histories.

This Bithumb event takes place amidst a broader pattern of security disclosures across crypto businesses. For example, Foundation, a manufacturer of hardware wallets, reported yesterday that its customers received over 23,000 phishing emails originating from its official domain after hackers compromised its Cloudflare API keys. Earlier in August, a provider named ShipMonk, associated with Trezor, suffered the theft of names, locations, and emails belonging to more than 67,000 users. More recently, Keystone Wallet, another significant provider, reported unauthorized access to its official website, resulting in the theft of customer shipping details, although wallet passwords and private keys were reportedly not compromised in that instance. Additionally, SlowMist claimed that a hacker exposed the contact details of more than 70,000 customers from a subset of users associated with Amplitude, a vendor for Coinbase; however, Coinbase support dismissed the breach claim, asserting they had seen no proof of unauthorized system access and confirming that user funds remained unaffected.

These developments underscore an intensifying focus by regulatory bodies and market participants on the resilience of digital asset infrastructure against sophisticated cyber threats.

Why it matters

These multiple data breaches highlight increasing security vulnerabilities across exchanges and financial firms in the crypto space. Regulators are actively investigating these incidents, signaling heightened scrutiny over institutional IT security practices. Readers should heed warnings about phishing attacks, even if their exchange data is compromised.