The breach hit the back office, not the vault
Bithumb, South Korea’s second-largest cryptocurrency exchange, confirmed on October 28 that an outside party broke into its internal mobile groupware and stole personal data. Groupware is the collaboration software a company uses for messaging, email, scheduling and document approvals — administrative machinery, not the systems that settle trades or hold funds. The exchange detected the unauthorized access on Tuesday, October 27, and says the compromised system is not used by customers and sits physically separate from its trading network. That separation is the single most important fact in the story: the confirmed loss so far is employee information, and Bithumb says customer assets were never exposed.
A narrow claim, not a clean bill of health
The groupware instance runs through Daou Office, a third-party platform common in South Korean workplaces. It typically holds staff details, internal communications and sometimes customer records, but not the production layer that moves money. A breach of that system is a real data-security failure even when the custody and trading layer is untouched. Bithumb has reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, and it is still investigating whether any customer data was exposed. That open question — customer data or only employee records — is what will determine how serious the incident ultimately is.
The exchange was not the biggest number
Bithumb disclosed the intrusion inside a wider wave of cyberattacks across South Korea’s financial sector, and it was not the firm with the largest confirmed exposure. Brokerage Daishin Securities said personal and credit information belonging to 38,490 customers was exposed after hackers reached a server linked to its online account-opening service. The leaked fields included names, email and physical addresses, bank names and account numbers, plus encrypted phone numbers and account details. Daishin detected suspicious activity on October 17 and then reviewed more than 60,000 requests disguised as legitimate traffic over a ten-day period, and said it found no evidence of unauthorized access to its core trading systems.
The pattern across the wave
Asset manager Mirae Asset Global Investments separately confirmed unauthorized access to some of its web systems, launched an emergency response after internal business information was exposed, and said preliminary findings showed no sensitive personal, credit or investor data compromised. Its affiliate Mirae Asset Life Insurance confirmed a customer data breach earlier in the week, drawing an on-site inspection by the Financial Supervisory Service. Lenders including Shinhan Bank, KB Kookmin Bank and Hana Bank reported customer data leaks earlier this month. Read together, the incidents point in one direction: the attackers are going after administrative and back-office systems, not the trading and custody infrastructure where the most damaging losses would sit.
What the regulator is telling the sector
The FSS has dispatched inspectors to Daishin and is assessing the incidents at Bithumb and Mirae Asset Global Investments. Governor Lee Chan-jin framed the wave as structural rather than a one-off, saying cyberattacks are ‘becoming increasingly sophisticated, with targets expanding to noncore systems,’ and warning that artificial intelligence could make it easier for hackers to find vulnerabilities and launch simultaneous attacks. He urged boards to take direct responsibility for cybersecurity rather than treating it as a compliance checkbox.
What still has to be settled
For Bithumb, three facts will settle the severity. First, whether customer data — and not just employee records — turns out to have been exposed. Second, the outcome of the FSS assessments across the affected firms. Third, whether the encrypted fields at Daishin held up, since the brokerage said phone numbers and account details were encrypted. Until those resolve, the honest read is narrow: a genuine data-security failure at an exchange, assets that the company says were never in the compromised system, and a wider campaign whose target is the back office rather than the vault.
Source: BlockchainReporter.