Security Guides

#data breach #unauthorized access #crypto exchange #phishing #identity documents #South Korea

Unauthorized Access to Bithumb's Internal Groupware (Personal Data of 844 Customers Exposed): ID Numbers, Account Numbers and More, and What Customers Should Do

Bithumb, a Korean crypto exchange, said on October 29, 2026 that an outside party accessed its internal mobile groupware on October 27. Per press reports, 844 customers' personal data was exposed, including ID numbers and ID copies. What to do.

Published 2026-10-30 Updated 2026-10-30 Last verified 2026-10-30 11 min read

On this page

For: people who hold or held a Bithumb account, and Bithumb employees. The report is based on Korean press coverage of Bithumb's announcement, and does not cover attack techniques.

Do not trust a call, text or email that mentions your ID or account details; check Bithumb's notice in the official app or site you open yourself

According to Korean press reports of Bithumb's announcement, an outside party accessed Bithumb's internal mobile groupware on October 27, 2026. The personal data of 844 customers was exposed, with items that vary by customer and include resident registration number, driver's license number, account number and ID card copies.

Check on Bithumb's site, which you open yourself, whether your information was exposed, and read the individual notice if you receive one
Do not use the links or phone numbers in a message that quotes your name, account number or ID details, and never share a one-time code or password
Do not send your ID or a copy of it again to anyone who contacts you first
If you see unfamiliar transactions or sign-in alerts, contact Bithumb through the official app or site

Developing: this article will be updated as the organisation publishes more

As of October 30, 2026

Not yet known

How the unauthorized access was obtained
Whether the count (844 customers, 715 employees) changes
Whether any misuse occurs (going forward)
Findings of the authorities

According to the reports, Bithumb is running security inspections and patches with the developer of the service, and will provide relief and compensation if secondary damage is confirmed. Bithumb's own notice returned an access error (HTTP 403) when we checked, so the numbers and items here are based on three Korean outlets that agree on them (Asia Economy, Hankook Ilbo, EBN). Financial News and Segye Ilbo are used only for the early stage. We found no follow-up announcement on October 30.

What customers should do today

Check whether you were affected

Bithumb posted a notice on its website and, according to reports, is contacting affected customers individually in sequence from the afternoon of October 29, 2026. The notice lets customers check whether their information was exposed. Open Bithumb's site or app yourself and use that page, not a link in a message.

Treat messages that quote your details as suspect

Name, mobile number, email address and account number together are enough to make a convincing fake. A call, text or email about "confirming the leak", "compensation" or "account verification" can be fake even if the details are correct. Do not use its links or phone numbers. Open the official app or site yourself. Never read out a one-time code, password or recovery phrase, and note that a real company will not ask for them. EBN's report of Bithumb's notice says the same: ignore calls or messages claiming to be Bithumb staff that ask for verification codes or push you to install an app, and report problems only through the official call center.

If your ID number or ID copy may be involved

The reports say the exposed items include resident registration number, driver's license number and ID card copies, depending on the customer. These can be used to pose as the holder.

Do not send your ID or a copy again to anyone who contacts you first
Watch for unfamiliar sign-up, loan or phone-contract notices in your name
See what to do when a driver's license number or copy is leaked for the general steps. The details for resident registration numbers follow the guidance of Korean authorities (we have not confirmed an official procedure for this incident)

Tighten your account protection

Bithumb says the exchange accounts were not directly breached. These steps are a sensible precaution (this site's recommendation).

Turn on two-step verification and a withdrawal address allowlist if the exchange offers them
Use a password that you use nowhere else, kept in a password manager
Check your recent sign-ins and withdrawals for anything you do not recognise

Employees

715 employees were also affected according to the reports. Follow the company's internal notice.

6,444 customers' records

Held in the internal mobile groupware

↓

5,600: DRM-encrypted

Could not be read from outside; not exposed

844: personal data exposed

Items vary by customer

715 employees

Also affected

The figures are from the reports (5,600 + 844 = 6,444).

Breakdown of the records involved (based on press reports of Bithumb's announcement)

What happened (according to Bithumb's announcement as reported)

Bithumb's own notice returned HTTP 403 when we checked on October 30. The following is from Korean press reports of its announcement on October 29, 2026 (Asia Economy, Hankook Ilbo and EBN). In the early stage, Financial News (October 28) reported that Bithumb was checking possible member data, and Segye Ilbo (October 29) that employee information was reported first and customer information was found later.

Oct 27, 2026, 11:28 to 12:27 (KST)
Per the reports, the period in which the abnormal access to the internal mobile groupware took place
Oct 27, 12:14
Bithumb first noticed the abnormal access, blocked the access path and stopped using the groupware
Oct 27 to 28
Bithumb notified the authorities, including the Korea Internet & Security Agency and the Personal Information Protection Commission, and first said employee information was involved
Oct 29
Bithumb announced that customer personal data was also exposed (844 customers), posted a notice and began notifying affected customers

844 customers

Personal data exposed (per reports of Bithumb's announcement)

6,444 customers

Records involved in total; 5,600 were in encrypted files that could not be read from outside

715 employees

Also affected (per reports)

From Bithumb's announcement (as reported)

System: An internal mobile groupware system, which Bithumb says is separate from exchange accounts and customer asset information
Items exposed (varies by customer): Name, mobile number, email address, resident registration number, driver's license number, account number, ID card copies
Not exposed: 5,600 of 6,444 customers' records were DRM-encrypted files that could not be accessed from outside
Exchange and assets: No direct intrusion into the exchange service or customer database has been confirmed, and no customer asset loss was reported
Response: Bithumb blocked the access path, stopped using the groupware, is running inspections and patches with the developer, and reported to the authorities
Compensation: Bithumb's CEO apologised and said the company will provide relief and compensation if secondary damage is confirmed

What is known and what is not

Status as of October 30, 2026. We will update this table as more is published.

Item	What was announced (as reported)	Status
Unauthorized access to the internal mobile groupware	Found on Oct 27; path blocked	Announced (company)
Customers whose data was exposed	844	Announced (company, via reports)
Total customer records involved	6,444, of which 5,600 were encrypted and not readable from outside	Announced (company, via reports)
Employees affected	715	Reported
Name, phone, email, resident registration number, license number, account number, ID copies	Included, varies by customer	Exposed (company, via reports)
Exchange service, customer database, customer assets	No direct intrusion confirmed; no asset loss reported	Not confirmed (company)
Passwords	Not listed among the items	Not stated
Misuse	None announced	Not stated
How the access was obtained	Not published	Under investigation
Authorities' findings	Not published	Not stated

Note: the figures come from press reports

We could not open Bithumb's own notice (HTTP 403), so the numbers and items are those that Korean outlets reported from Bithumb's announcement. We have not added to them or guessed at the cause. If Bithumb's notice differs, we will correct this page.

What these items could be used for

The following is what can generally happen with this combination of items. Bithumb has not announced that any of it has happened.

Name + mobile number + email address: material for convincing fake calls, texts and emails posing as the exchange or an authority
Account number + name: material for messages posing as a refund, compensation or account check
Resident registration number, driver's license number, ID copy: material for posing as the holder, for example in a fake sign-up or a request to "verify" an identity. A number or copy alone does not move assets held at the exchange. In this site's view, it could also be used to make a request to reset an account look genuine (a general point; nothing like this has been announced)
Most of this can be prevented by not using the links or numbers in a message, by never sharing a one-time code or password, and by turning on two-step verification

What operators should review

The method of access has not been published, so this section covers only what can be said from the announcement.

Which personal data sits in internal work tools: the exposed data was in a groupware system separate from the exchange. Check which ID documents and account details are kept in such tools, for how long, and who can open them
Encryption of files: according to the reports, 5,600 of 6,444 records were in DRM-encrypted files that could not be read from outside. File-level protection limited the exposure
Detection to notification: the reported access window was about an hour and the access was noticed within it. Check that the time from detection to blocking and to reporting to the authorities is rehearsed

Sources (public records)

The facts in this article are based on the public information below. Bithumb's own notice returned HTTP 403 when we checked on October 30, 2026. We have not guessed at the cause.

Asia Economy, report on the personal data of 844 Bithumb customers exposed through its internal system (Korean, October 29, 2026, checked October 30) — view.asiae.co.kr
Hankook Ilbo, report on the Bithumb customer data exposure (Korean, October 29, 2026, checked October 30) — hankookilbo.com
EBN, report on the Bithumb personal data incident and the company's cautions (Korean, October 29, 2026, checked October 30) — ebn.co.kr
Segye Ilbo, early-stage report on the Bithumb customer information leak (Korean, October 29, 2026, checked October 30) — segye.com
Financial News, first report on intrusions at Bithumb and other financial firms (Korean, October 28, 2026, checked October 30) — fnnews.com

Update history

2026-10-30: First version, based on Korean press reports of Bithumb's announcements of October 28 and 29 (checked October 30; no follow-up found). We will update when the cause, any change in the numbers, or the authorities' findings are announced.

Latest breaking reports

All breaking reports →

FAQ

QWhat was exposed in the Bithumb incident?

According to Korean press reports of Bithumb's announcement, the items vary by customer and include name, mobile number, email address, resident registration number, driver's license number, account number and ID card copies. The data was in Bithumb's internal mobile groupware system.

QAm I affected?

Bithumb said it is notifying affected customers individually, in sequence from the afternoon of October 29, 2026, and that customers can check on its website whether their information was exposed. Reports give 844 customers as exposed. Use the official notice on Bithumb's site or app, which you open yourself.

QWere my coins or exchange password affected?

Bithumb says the groupware is separate from exchange accounts and customer asset information, and the reports say no direct intrusion into the exchange service or customer database has been confirmed. No customer asset loss was reported as of October 30, 2026. Passwords are not on the list of exposed items, but see the steps below, since the exposed items can be used to pose as the exchange.

QWhat caused it?

Bithumb describes it as abnormal access to the internal mobile groupware by an unauthorized outside party, and says it blocked the access path and stopped using the groupware. How the access was obtained has not been published.

QWhat if I get a call, text or email claiming to be Bithumb or an authority?

Do not use its links or phone numbers, and never read out a one-time code, password or recovery phrase. Having your name or account number right does not prove a message is genuine. Check the notice in the official app or site you open yourself.

QCan my resident registration number or ID copy be misused?

Bithumb's CEO said the company will provide relief and compensation if secondary damage is confirmed. No misuse has been announced. In general, ID numbers and ID copies can be used to pose as the holder, so decline any request to send them again and see the linked guide for what to do.