Most exchange hacks start with a wallet. Bithumb’s started with the office messenger.
South Korea’s second-largest crypto exchange said it found an outsider inside its employee-only mobile groupware on Tuesday, 27 October, and that personal data had leaked, Yonhap reported at 9:12 AM Seoul time on Wednesday (5:42 AM IST). The system, Daou Office, is a work and messaging app staff use on their phones. Bithumb says it is physically separate from the trading network and that no crypto was taken.
That is the company’s account. What regulators did next is the bigger signal.
What leaked, and what didn’t
At an emergency meeting on 28 October, Bithumb told Korea’s Financial Services Commission that information on staff at Bithumb, its subsidiaries and partner companies had leaked after “abnormal external access,” ChosunBiz reported. Whether any customer data leaked is still being checked. Digital Today adds that the number of people affected, the types of data and the attack route are not yet known.
So far, no leak has been confirmed of anything usable for fraudulent payments or crypto transfers, such as wallet addresses. Bithumb reported the breach to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission on the day it noticed.
The Financial Services Commission, the Financial Supervisory Service and the Financial Security Institute have started an on-site inspection. The FSC says that if customers lose money, it will oversee protection measures including full compensation. It also wants sectors outside the Electronic Financial Transactions Act, crypto exchanges included, to bring security up to bank level.
Why a staff app is a real risk
A groupware leak doesn’t move coins. It hands attackers something almost as useful: names, phone numbers, email addresses, job titles and the internal tone of a company. That is the raw material for convincing phishing, both against other employees (the usual route to a wallet) and against customers, if their data turns up in shared files.
CryptoWatchDesk notes that Yonhap Infomax described the system as built by an outside contractor, and that Korea’s National Security Office called a meeting on the Bithumb and Mirae Asset hacks. Third-party tools at the edge of a company, not its core servers, are where this one got in.
BtcMedia comparison: the same breach under Indian rules
Here is how the reporting clock would run if an Indian exchange’s staff app were breached the same way. The Indian rules are from the CERT-In directions of 28 April 2022 and the Digital Personal Data Protection Rules, 2025.
| Step | Bithumb (what it did) | Indian exchange (what the rules require) |
|---|---|---|
| Tell the cyber agency | Reported to KISA the same day | Report to CERT-In within 6 hours of noticing |
| Tell the privacy regulator | Reported to PIPC the same day | Tell the Data Protection Board without delay, with a detailed report within 72 hours |
| Tell affected people | Staff notified; customer notice only if their data is confirmed | Tell each affected person without delay, with the likely consequences and steps to protect themselves |
| Keep records | Not disclosed | Keep KYC and transaction records for 5 years (CERT-In, which names virtual asset exchanges) |
The DPDP Rules were notified in November 2025 and phase in under MeitY’s enforcement timeline, so the 72-hour duty applies once those provisions are in force. The six-hour CERT-In rule has applied since 2022.
The gap Korea’s FSC is now trying to close exists in India too: neither country has an exchange-specific cyber regulator like the banking rulebook. Indian exchanges register with FIU-IND for anti-money-laundering duties, while their cyber obligations come from rules that apply to every company.
What it means for Indian investors
Bithumb doesn’t serve Indian users, so there is no direct exposure. The lesson carries over, though. India’s largest exchange, CoinDCX, has just absorbed a $15.99 million loss from old wallets, as we covered last week. Breaches rarely end with the first notice.
- Treat any call, SMS or email about an “urgent account problem” as phishing until you check it inside the official app.
- Never share an OTP, password or seed phrase; no exchange support team needs them.
- Keep long-term holdings you don’t trade off the exchange, and turn on withdrawal address whitelisting where offered.
BtcMedia verdict
The coins are safe, by Bithumb’s account, and the fast same-day report is the right reflex. But the story isn’t finished until Bithumb says whether customer data was in those shared files. Until then, the phishing risk is the one to watch.
FAQ
Did Bithumb lose any crypto? No. Bithumb says the breached groupware is physically separate from its trading network, and no crypto theft has been reported.
Was customer data leaked? Not confirmed. Staff, subsidiary and partner data leaked; Bithumb is checking whether customer information was in files shared on the system.
How quickly must an Indian exchange report a hack? Within six hours of noticing it, to CERT-In, under the 2022 directions. Under the DPDP Rules, a detailed report to the Data Protection Board is due within 72 hours.
How we compiled this: Bithumb and FSC statements as reported by Yonhap, ChosunBiz and Digital Today on 28 October 2026, checked at 8:55 PM IST, compared with the text of India’s CERT-In directions and DPDP Rules. This is not financial or legal advice.