Bithumb Customer Data Leak Poses Phishing Threat to Users

The South Korean exchange Bithumb, the second largest in the country, reported a leak of customer personal data after an outsider gained unauthorized access to one of its internal work tools. According to Yonhap, on October 27, the exchange detected abnormal external access to its internal mobile group interaction system. The exact scale of the leak is still being determined.

Other Affected Parties

The incident affected not only Bithumb. Daishin Securities reported that data of more than 38,000 of its clients leaked, including names, email addresses, and phone numbers. Mirae Asset Global Investment was also affected. The Financial Supervisory Service of South Korea (FSS) is investigating all three cases and has already sent a field team to Daishin.

At a meeting with the chairmen of eight banking holdings, FSS Director Lee Chang-jin demanded enhanced IT security: “As artificial intelligence is used as a means of hacking attacks, vulnerabilities will be easily detected, and simultaneous attacks will become a regular occurrence.” He added that boards of directors should take a leading role in enhancing company security.

CZ's Warning

Binance co-founder Changpeng Zhao (CZ) responded to the news, addressing his 12.9 million followers on X: preventing leaks may be impossible, but you can protect yourself. According to him, leaked exchange data most often fuels phishing and SIM swap attacks. He recommended using a unique email alias for each exchange, hardware keys or passkeys instead of SMS codes, reducing the amount of information transmitted, and locking accounts. “Consider anyone contacting you about your account, ‘security issues,’ or ‘refunds’ a scammer, even if they know your name, balance, or recent trades,” CZ warned.

Wave of Incidents

The Bithumb case is part of a series of other disclosures. Recently, hardware wallet manufacturer Foundation reported that its clients received over 23,000 phishing emails from the company's official domain after API keys were compromised on Cloudflare. In August, Trezor provider ShipMonk had names, addresses, and emails of more than 67,000 users stolen. Later, Keystone Wallet reported that outsiders gained access to its website and stole customer delivery data, but not passwords or private keys.