Bithumb confirms data leak affecting 6,444 customers, with 844 having readable information exposed

6,444 customers and 715 staff members affected

Bithumb clarified on October 29, 2026, the scope of the October 27 intrusion into Daou Office, its internal mobile work tool. Its notice identifies 6,444 affected customers and, separately, 715 employees and associates. The group says data for 5,600 customers was encrypted and its contents were inaccessible, while information concerning the other 844 was exposed. This update expands the initial reports, which mainly concerned staff; the customer scope can therefore no longer be described as entirely unknown.

According to Bithumb, potentially exposed information includes names, phone numbers, email addresses, administrative identification numbers, bank details, and copies of identity documents, with the scope varying by person. The company says the compromised tool is separate from platform accounts and information about assets held. It reports no evidence of a direct breach of the exchange service or its customer database. That statement must remain attributed: the company has established a personal-data leak, but this does not constitute proof of cryptocurrency theft.

Other institutions' incidents have their own figures

The same news sequence mentions Daishin Securities and Mirae Asset. The reported figure of 38,490 customers whose data was exposed at Daishin does not concern Bithumb. Attaching that total to the crypto platform would give its incident an unestablished scale. The companies, targeted systems and information categories are different. Even when several cases are published on the same day, they must retain their own facts, dates and limits, rather than being artificially combined into one count of crypto victims.

Reports also mention North Korean IP addresses observed during attempts targeting the financial sector. That general technical observation does not establish with certainty that an identified actor was responsible for the Bithumb intrusion. An apparent connection origin, vulnerability scanning and a successful attack are distinct elements. Nor does the case establish that every incident mentioned used the same method. Identifying those responsible and establishing the precise timeline remain matters for investigators.

IT security becomes a governance issue

In a separate October 28 release, the Financial Supervisory Service describes a meeting with board chairs from eight banking groups. Strengthening IT security, internal controls and risk management features among the topics discussed. This official document provides a sector-supervision context; it is not a quantified notice specific to Bithumb. The distinction avoids attributing conclusions about the platform's customers to the regulator when its text does not publish them.

Bithumb says affected customers will receive individual notices, be able to check their exposure, and benefit from enhanced monitoring of unusual transactions and withdrawals. The company says it blocked access and suspended the affected tool, then reported the incident to authorities. It promises support and remediation procedures for confirmed harm, without this proving that compensation has already been paid. Disclosed data can facilitate impersonation or phishing; the notice establishes no amount of cryptocurrency stolen.