Bithumb Users Face Phishing Risks After Reported Data Leak

Reportedly, some customer personal data from Bithumb, South Korea's second-largest crypto exchange, was leaked on October 28. This occurred after an external, unauthorized party accessed one of the exchange's internal workplace tools.

This incident follows a series of similar breaches affecting both traditional financial firms and crypto companies.

According to the Yonhap News Agency, Bithumb detected abnormal access by an outsider on October 27 within its internal mobile groupware system. While the exchange is still determining the full extent of the breach, another firm, Daishin Securities, reported that information for over 38,000 customers, including names, phone numbers, and emails, was compromised.

Mirae Asset Global Investment was also affected. Korea's Financial Supervisory Service (FSS) is investigating all three incidents and has dispatched a team to Daishin. FSS Director Lee Chan-jin stated at a meeting with eight bank holding company chairmen, "As artificial intelligence is used as a means of hacking, security vulnerabilities will be easily detected and simultaneous attacks will become a regular occurrence." He further noted that boards must now assume responsibility for enhancing their companies' security capabilities.

Binance co-founder Changpeng Zhao (CZ) advised his 12.9 million followers on X that while preventing leaks might be impossible, users can protect themselves by sharing less information and securing accounts. He advised that leaked exchange data primarily facilitates phishing and SIM-swapping attacks. CZ recommended employing a distinct email alias for every exchange and utilizing hardware keys or passkeys over SMS codes. He cautioned, "Assume anyone who contacts you about your account, 'security issues,' or 'refund recovery' is a scammer, even if they know your name, balance, or recent trades."

The Bithumb event occurs amidst other security disclosures. Foundation, a hardware wallet maker, reported yesterday that its customers received over 23,000 phishing emails from its official domain after hackers compromised its Cloudflare API keys.

Earlier, in August, ShipMonk, a Trezor provider, experienced the theft of names, locations, and emails belonging to more than 67,000 users. More recently, Keystone Wallet reported that unauthorized individuals accessed its official website and stole customer shipping information, though wallet passwords and private keys were not compromised.

Furthermore, SlowMist claimed that a subset of Coinbase users had their contact details exposed in an incident today involving Amplitude, a Coinbase vendor, with more than 70,000 customers reportedly affected. However, Coinbase support dismissed the breach designation, stating it saw no evidence of unauthorized system access and that user funds remained unaffected.