Bithumb data breach hits internal mobile system as Coinbase flags vendor leak

South Korea's run of financial-sector hacks has reached one of its biggest crypto exchanges. The Bithumb data breach, disclosed on Wednesday, came through the internal mobile groupware that employees use for work, and the company is still working out whether customer records were part of it.

What happened

Bithumb learned on Tuesday of abnormal access by an unauthorized outside party and reported it the same day to KISA, the national internet security agency, and to the country's privacy regulator, DigitalToday reported. Data identified so far relates mainly to employees, but the exchange has not ruled out member information; the number of people affected and the types of data are still unconfirmed, as are the attacker and the route of intrusion.

Yonhap, citing an industry source, reported that some personal information of Bithumb customers was leaked. The exchange told Yonhap that its internal work system is separated from the trading system, so customer virtual assets cannot be reached through this breach, Cointelegraph said.

Bithumb was not alone. Daishin Securities said personal information of 38,490 customers, including names, email addresses and phone numbers, was hacked, and financial authorities began inspecting a breach at Mirae Asset Global Investments, Yonhap reported. Lee Chan-jin, who heads the Financial Supervisory Service, said 16 Korean financial firms had suffered cyberattacks as of Oct. 14, according to Cointelegraph.

Why it matters

Leaked contact details are raw material for phishing even when funds are safe. Coinbase made the same point on Wednesday: it said an incident at analytics provider Amplitude exposed contact information for a "small subset" of its customers, that its own systems were not accessed and that funds remain secure, CoinDesk reported. Coinbase did not say how many users were affected or which fields were exposed. It is emailing affected customers as required by law, and CoinDesk noted that the episode highlights supply-chain risk: users can be exposed through a vendor even when an exchange's core systems hold.

Attacks through side doors keep coming. Hardware wallet maker Keystone's data breach exposed buyers' shipping addresses, and the Bloom bot hack drained user wallets in under a minute this week. The Bithumb data breach adds an internal staff tool to that list.

What's next

The groupware at the center of the Bithumb data breach is a platform staff use to reach work functions from their phones, and Bithumb has already notified its employees. It said it will share more details as the investigation progresses and may issue customer notices if member data turns out to be involved. The exchange, which has set a 2028 IPO timetable according to Cointelegraph, will face questions from regulators on its internal controls. Users of affected platforms should be wary of unexpected messages that cite account details. DigitalToday's report on the intrusion has the company's statement.