Short answer
Bithumb said an outside party got into its internal mobile groupware (DaouOffice) for about an hour on 27 October 2026. The company confirmed that data on 844 customers and 715 staff was exposed, and says its exchange and customer database were not breached.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Bithumb |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Cryptocurrency exchange |
| Country | South Korea |
| Detected | 2026-10-27 |
| Disclosed | 2026-10-29 |
| People or records affected | 844 customers and 715 employees and partners had data exposed. 6,444 customers were linked to the incident, but Bithumb says 5,600 of those records were in encrypted files that could not be opened. |
What data was exposed
- Names, phone numbers and email addresses (varies by customer)
- Resident registration numbers and driver's licence numbers (some customers)
- Bank account numbers (some customers)
- Copies of ID cards (some customers)
What happened
Bithumb, a South Korean cryptocurrency exchange, said an outside party gained unauthorized access to its internal mobile groupware, DaouOffice, on 27 October 2026. According to Toyo Economy, the access ran from 11:28 to 12:27. Bithumb noticed the abnormal activity at 12:14, blocked the route and suspended the groupware.
Bithumb disclosed the result on 29 October. SBS Biz reports that 844 customers and 715 employees and partners had personal data exposed, 1,559 people in all.
What was exposed
The fields vary by person. They include names, phone numbers, email addresses, resident registration numbers, driver’s licence numbers, bank account numbers and copies of ID cards. Of 6,444 customers linked to the incident, Bithumb says 5,600 had data in encrypted files that could not be opened from outside, so only 844 were exposed.
What Bithumb says
Bithumb says the groupware is separate from the systems that manage customer accounts and assets, and that it has found no sign the core exchange or customer database was breached. It is texting affected customers individually and runs a website where users can check whether their data was involved. CEO Lee Jae-won apologized and said Bithumb would provide relief and compensation if secondary harm such as voice phishing is confirmed.
Toyo Economy reports that Bithumb notified KISA on 27 October and the Personal Information Protection Commission on 28 October. It also says the Financial Supervisory Service began an on-site inspection on 28 October. Some outlets said the announcement was later than first planned while the company confirmed the scope. We have not seen a regulator finding about the incident.
Why ID copies matter
A resident registration number with an ID card copy is the kind of data used to impersonate someone at a bank or exchange. It also lets a caller sound credible when posing as staff. Our guides to phishing messages and crypto scams show the common patterns, and the data breach checklist lists the steps to take first.
What to watch next
Watch for the outcome of the Financial Supervisory Service inspection and any Personal Information Protection Commission decision. This incident follows a run of Korean financial sector intrusions this month, covered in our Korean financial sector hacks report. More cases are on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or texts pretending to be Bithumb or another financial firm, quoting your name or account number to look genuine.
- Identity theft attempts that use a resident registration number and ID card copy to open accounts or loans in your name.
- Voice phishing that tells you to move crypto or cash to a 'safe wallet' or 'safe account'.
- Fake 'check if your data leaked' links that imitate Bithumb's lookup page.
What to do if you are affected
- 01Use only the lookup page on Bithumb's official website to see whether your data was involved. Do not follow links from texts or messages.
- 02If you were notified, treat any call about your Bithumb account, wallet or ID as suspect. Hang up and call the number on the official site.
- 03Never move crypto or cash to a wallet or account on a caller's instruction, and never share OTP codes or seed phrases.
- 04If your resident registration number or ID copy was exposed, ask your bank and credit bureau about fraud alerts, and use Korea's service for blocking new phone lines and accounts opened in your name.
- 05Report voice phishing to the police on 112 and suspicious links or texts to KISA on 118.
Frequently asked questions
What did the Bithumb breach expose?
Names, phone numbers, emails, resident registration numbers, driver's licence numbers, account numbers and ID card copies. The mix differs by customer, and 844 customers had data exposed.
Was my crypto stolen?
Bithumb says the groupware is separate from the systems that hold accounts and assets and that it has seen no sign of a breach of the core exchange or customer database. Reports do not mention stolen funds from this incident.
Why does Bithumb say 6,444 customers but only 844 were exposed?
Bithumb says 5,600 of the 6,444 customers linked to the incident had data in encrypted files that could not be read from outside. The other 844 were stored in a form that could be read.
Who was told about the incident?
According to Toyo Economy, Bithumb reported it to KISA on 27 October and to the Personal Information Protection Commission on 28 October. The Financial Supervisory Service began an on-site inspection on 28 October.
Sources
- Bithumb confirms leak of 844 customers' personal data (Korean-language article, headline in English), Toyo Economy (sateconomy), 2026-10-29
- Bithumb: additional leak of 844 users' personal data (Korean-language article, headline in English), SBS Biz, 2026-10-29
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.