Cyber Incident Victim: Bithumb
Date:
Oct 2017
Location:
South Korea
Summary
A security breach at Bithumb, a major cryptocurrency exchange, compromised sensitive personal and financial data of approximately 30,000 users after attackers infiltrated employee emails to gain system access. While no user funds were stolen during the incident, the intrusion prompted an investigation by South Korean authorities, including the Seoul Central Prosecutor’s Office, to analyze the attack and trace the responsible hacking group. The breach highlighted vulnerabilities in the platform’s security infrastructure despite its status as one of the largest trading venues by volume.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around October 16, 2017, South Korean news outlets reported a security breach at Bithumb, the world’s largest cryptocurrency exchange by trading volume at the time. The incident impacted approximately 30,000 users of the platform. Attackers gained unauthorized access by compromising the email accounts of Bithumb employees, which enabled them to infiltrate the exchange’s internal systems. While no user funds were stolen during the breach, sensitive personal and financial information belonging to the affected users was exposed. The scale of the breach drew immediate attention due to Bithumb’s dominant market position and the growing regulatory scrutiny surrounding cryptocurrency exchanges in South Korea.
The Seoul Central Prosecutor’s Office for Advanced Criminal Investigation assumed control of the case shortly after the breach was disclosed. Investigators focused on analyzing the attack methodology and tracing digital evidence to identify the responsible hacking group, which remained anonymous at the time of reporting. Authorities confirmed that the breach did not compromise cryptocurrency wallets or result in direct financial theft, but emphasized the severity of the personal data exposure. The investigation remained active as forensic teams worked to establish a definitive attribution for the attack. No additional technical specifics regarding the compromised systems or data types were publicly confirmed beyond the acknowledgment of email system infiltration and subsequent unauthorized access to user information.