Cyber Incident Victim: Bithumb
Date:
Mar 2019
Location:
South Korea
Summary
A South Korean cryptocurrency exchange experienced a significant security breach resulting in the theft of approximately $21 million worth of digital assets, including 3 million EOS and 20 million XRP. The stolen funds were laundered through non-KYC exchanges, with the incident confirmed as a hot wallet compromise rather than initially suspected cold storage targeting. This marked the platform's second major hack within a year, following prior losses exceeding $30 million. The organization attributed the theft to insider involvement and asserted plans to recover the assets while highlighting enhanced internal security measures implemented after the breach.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 4, 2021, Bithumb, a major South Korean cryptocurrency exchange, suffered a security breach resulting in the theft of approximately $21 million in digital assets. Attackers stole 3 million EOS tokens (valued at $13 million) and 20 million XRP (valued at $8 million) from the exchange’s hot wallets. The stolen funds were rapidly transferred out of Bithumb’s systems and laundered through non-KYC cryptocurrency exchanges such as ChangeNow, complicating recovery efforts. Initial concerns that the breach involved cold storage systems were later dismissed, with confirmation that only hot wallets were compromised. This marked Bithumb’s second significant security incident within a year, following a prior hack that resulted in over $30 million in losses.
Bithumb attributed the theft to "an accident involving insiders" but did not disclose specific technical details or employee involvement. The exchange publicly committed to recovering the stolen funds, though no timeline or methodology for recovery was provided. In response to the breach, Bithumb emphasized enhancements to its internal security protocols, though it did not specify the nature of these improvements. The incident highlighted ongoing vulnerabilities in the exchange’s operational security, particularly regarding hot wallet management and insider risk controls. Market monitoring indicated no immediate disruption to Bithumb’s trading operations following the breach, though the recurrence of high-value thefts eroded user confidence in the platform’s security infrastructure.