Crypto exchange Bithumb says outsider breached employee system, took personal data
In brief
- Bithumb said an outsider broke into its internal employee mobile system and took personal information.
- Bithumb says the breached system runs separately from its trading platform.
- No crypto funds had been reported lost as of Asian afternoon hours.
- Regulators are assessing Bithumb, Daishin Securities and Mirae Asset after a wave of attacks.
What Bithumb has said so far
According to Korean media cited by CoinDesk, the exchange found the intrusion on Tuesday. It reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission.
Bithumb told Yonhap it's still working out the exact scope of the breach (including whether member information was involved). The company also said the breached system runs separately from its trading platform, so customer virtual assets couldn't be accessed through it.
Bithumb hasn't said whether deposits or withdrawals were affected, or how many people's data was exposed.
A wider wave across Korean finance
Bithumb wasn't the only target. The Financial Supervisory Service said on Wednesday it was assessing three financial firms, and Bithumb was one of them. Daishin Securities said personal and credit information for 38,490 of its customers leaked in an outside attack, while Mirae Asset Global Investments said it blocked abnormal access to some of its web systems and that investor information wasn't affected.
FSS Governor Lee Chan-jin raised the incidents directly with the heads of the country's bank holding companies.
“I understand that major financial investment companies experienced overall hacking incidents yesterday,” FSS Governor Lee Chan-jin told a meeting with bank holding company chairs.
Earlier this month, Lee said cyberattacks had hit 16 South Korean financial firms as of Oct. 14.
Internal controls, again
The breach follows a separate internal-controls failure at the exchange earlier this year. In February, Bithumb mistakenly credited customers with 620,000 BTC (worth more than $40 billion at the time) instead of 620,000 won. CEO Lee Jae-won blamed that error on weak internal controls at the time.
This time it's an employee system rather than a ledger error, and the company says customer assets sit on a separate platform. What it hasn't yet disclosed is how far the data exposure goes.
Frequently asked questions
Were customer crypto funds affected by the Bithumb breach?
As of Asian afternoon hours on Wednesday, no crypto funds had been reported lost. Bithumb said the breached employee system runs separately from its trading platform, so customer virtual assets couldn't be accessed through the breach.
Was Bithumb customer data exposed in the hack?
Bithumb said personal information was taken from its internal employee system. It told Yonhap it was still working out the exact scope, including whether member information was involved, and it hasn't said how many people's data was exposed.
