South Korean exchange Bithumb has said an outside party got into its internal mobile groupware system and leaked personal information, according to Yonhap News Agency. On the same day, Coinbase said a security incident at its analytics vendor, Amplitude, exposed contact data for some of its customers. If you hold crypto on a large exchange, the real risk is less about your coins vanishing overnight and more about the messages that follow: convincing emails, texts and calls that use leaked details to look genuine.
What happened at Bithumb
Bithumb is South Korea's second-largest crypto exchange. It said an unauthorized outside party accessed an internal mobile groupware system, which is the kind of tool staff use to communicate and work together. According to CoinDesk, Bithumb says this employee system is separate from its trading platform, and the company is still working out whether customer information was exposed.
That answer is not settled. Decrypt, citing Reuters and Yonhap, reports that the investigation into customer data is ongoing, while an industry source told Yonhap that some Bithumb customers' personal information had in fact leaked. Protos describes the number of affected users as unspecified. Bithumb has not said how the system was accessed, according to Decrypt.
It was not only Bithumb
Decrypt reports that Bithumb was one of three South Korean financial firms to disclose breaches on Wednesday. Brokerage Daishin Securities said data on 38,490 customers had leaked, and asset manager Mirae Asset Global Investments also confirmed a hacking incident. Reuters, cited by Decrypt, noted that this follows attacks on 16 South Korean financial firms, including banks, that the Financial Services Commission said had caused around 100,000 data leaks earlier this month. Protos adds that the presidential office held an emergency meeting on the incidents.
Coinbase, meanwhile, stresses that it was not breached itself. It says the problem sat with Amplitude, that only a "small subset" of customers was affected, that it found "no evidence of unauthorized access to Coinbase systems," and that customer funds were not impacted, as quoted by Protos.
| Firm | What was reported | What is still unclear |
|---|---|---|
| Bithumb (South Korea) | Outside party accessed an internal mobile groupware system; personal information leaked | Whether and how much customer data was exposed; how the system was accessed |
| Coinbase (via vendor Amplitude) | Contact data of a small subset of customers exposed; Coinbase says funds were not affected | Which customers were affected (Coinbase says its own systems were not accessed) |
| Daishin Securities (South Korea) | Data on 38,490 customers leaked. Decrypt lists names, email addresses and mobile numbers; Protos also mentions credit card details | Exact data fields, given the differing reports |
| Mirae Asset Global Investments (South Korea) | Hacking incident confirmed; regulators have begun an inspection | Protos says customer details reportedly did not appear to have leaked |
Why a leak of "just contact details" still matters
A name, email address and phone number do not unlock an account on their own. What they do is make a scammer's message believable. Binance founder Changpeng "CZ" Zhao, listing the four incidents in a post on Wednesday, warned that leaked exchange data "is mostly used for phishing, SIM swapping, and social engineering." He also said leaked addresses and holdings data "have led to real-world extortion and robberies."
History backs up the worry. Protos recalls that a 2017 leak affecting 31,000 Bithumb users led to the theft of crypto worth 5.9 million. It also notes that data from about 6,000 Coinbase users leaked in 2021 and was followed by a social engineering campaign that tried to take over accounts and steal crypto. Leaks tend to be followed by targeted attempts, not random ones.
What this means for you: a practical plan
You cannot stop an exchange or its vendor from being breached. You can make a leak much less useful to whoever holds it. Start here.
1. Find out whether you were told you are affected
Check your exchange's official app or website, typed in yourself or opened from your own bookmark, for a security notice. Check the email account you signed up with as well. Companies usually contact affected customers directly. If you use Bithumb, remember that the company has not yet said whether customer data was exposed, so an absence of news is not a clean bill of health. Daishin, for its part, said it would compensate customers for resulting damage in accordance with the law.
2. Treat unexpected "support" contact as suspect
After a leak, assume that a message claiming to be from support, security or compliance could be fake, especially if it creates urgency. Warning signs include:
- A password-reset email or text you did not request.
- A call or message saying your account is "compromised" and asking you to act immediately.
- A link to log in, verify your identity or "secure your funds."
- Any request for a one-time code, recovery phrase or remote access to your device.
Do not click or reply. Open the exchange yourself and see whether the same alert appears inside your account. An unexpected reset request can also mean someone is trying to get in, so do not approve it, and check your account's security settings afterwards.
3. Follow the protective steps CZ listed
Zhao's advice was that you cannot prevent a leak but you can protect yourself. His three suggestions:
- Sign up to each exchange with a unique email alias, so a leaked address cannot be matched across services.
- Avoid text message-based two-factor authentication, since SIM swapping targets phone numbers.
- Ask your phone carrier for a number lock.
If you currently use SMS codes, look in your exchange's security settings for another two-factor option. Changing the email on an existing account is a bigger step, so follow the exchange's own instructions for it.
4. Keep quiet about your holdings
Because leaked holdings data has fed extortion and robberies, according to Zhao, avoid telling strangers online what you own. Be cautious of anyone who contacts you already knowing details about your account.
A note on the wider picture
Protos points out that Coinbase has faced earlier incidents. In 2024, criminals hired customer support staff to steal data affecting almost 70,000 users, and Coinbase refused to pay a $20 million ransom. In December 2025, a contractor accessed data on around 30 users. Protos also reports a breach at Monero swap firm Wagyu, where a ransomware group called WhiteArmor leaked three months of customer data, reportedly after Wagyu refused a $5 million ransom. The lesson is not that one exchange is safe and another is not. Data held by companies, staff and vendors can leak, so your own habits are the part you control.
Separately, according to Decrypt, South Korea's Science Ministry and the Korea Internet & Security Agency urged website operators to check for recently disclosed flaws in PHP that let attackers run commands on a server without logging in. Bithumb has not linked its incident to that issue, so treat the two as unrelated for now.
FAQ
Were Bithumb customers' funds stolen?
None of the reports describe stolen funds. CoinDesk says Bithumb describes the affected system as an internal employee system separate from its trading platform. The open question is whether customer personal information was exposed, and the exchange is still investigating.
I use Coinbase. Do I need to do anything?
Coinbase says the problem was at its analytics vendor Amplitude, that only a small subset of customers had contact data exposed, and that funds were not affected. Check your inbox and account for a notice from Coinbase, and be wary of any unexpected message that appears to refer to the incident.
How can I tell a real exchange message from a phishing attempt?
Do not judge by the sender name or the details in the message, since leaked data can make a fake look accurate. Instead, ignore the links, open the exchange's app or website yourself, and look for the same notice there. Never share one-time codes or recovery phrases with anyone who contacts you.
Sources
- Decrypt: Bithumb Says Hackers Accessed Internal System, Leaking Personal Data
- CoinDesk: Bithumb hacked through employee system as South Korean financial firms face cyberattacks
- Protos (hacks, scams, investigations): Coinbase and Bithumb users hit by data leaks
Photo: RDNE Stock project / Pexels
I'm an Italian creator who builds apps, games and websites. I run Crypto Radar Daily with the help of AI tools: every article starts from the sources linked above, and I check what goes out. I'm not a doctor, a lawyer or a financial adviser. Spotted a mistake or have an idea? Write to me.
Instagram @spartaco_94_My websiteWrite to meAbout this blog