South Korea's Bithumb and Two Other Financial Institutions Breached by Hackers: Nearly 40,000 Customer Records Leaked; Regulators Step In to Investigate

Author: TechFlow

TechFlow Editorial Note:South Korea's financial and crypto-asset industry is facing a highly cautionary coordinated cybersecurity storm. On October 28, authoritative media confirmed that Bithumb, South Korea's second-largest cryptocurrency trading platform; Mirae Asset, a leading asset management giant; and Daishin Securities, an established brokerage, successively confirmed malicious external intrusion and data exfiltration.

Daishin Securities has confirmed that sensitive personal and credit data of nearly 40,000 customers was stolen, while Bithumb's internal mobile office collaboration network was also illegally breached; it is urgently verifying whether members' trading information was affected. After the incidents emerged, South Korea's top financial regulator, the Financial Supervisory Service (FSS), swiftly dispatched a special on-site inspection team to conduct a deep review.

Senior regulators also issued a rare highest-level security advisory, stating that artificial intelligence has been deeply weaponized by hackers for vulnerability discovery and automated intrusion, accelerating the exposure of vulnerabilities in the financial system. This not only signals the collapse of traditional passive defense systems, but also raises a systemic global alarm for financial and Web3 infrastructure against the malicious evolution of AI.

Successive Breaches: Crypto Giant and Traditional Brokerage Suddenly Breached by External Intrusion

This cybersecurity black swan sweeping South Korea's financial sector first tore open a rift between traditional brokerages and leading crypto platforms. As disclosed by theYonhap News Agency report, Daishin Securities officially announced on October 28 that 38,490 customers' personal information and key credit data had been stolen by external hackers.

At the same time, Bithumb, South Korea's second-largest cryptocurrency exchange, also raised red flags. Bithumb's internal monitoring system detected abnormal traffic on October 27 and confirmed that its mobile office collaboration system had been illegally accessed by unauthorized external entities, with some internal sensitive data leaked.

Bithumb is currently in a state of high alert, with its technical team working closely with external security experts to urgently investigate the attack path. The key focus of the official assessment is whether the compromise of the collaboration system has further penetrated laterally into its core member database and on-chain wallet management system.

Meanwhile, Mirae Asset Global Investments, a leading South Korean fund management institution, was also confirmed to have been affected in this wave of attacks. The successive breaches of three institutions holding core positions in different financial sectors suggest that hackers likely carried out an organized, coordinated assault targeting South Korea's financial supply chain.

Regulators Intervene Swiftly: FSS Deploys On-Site Penetrating Review

In response to this major security incident that could undermine trust in financial markets, South Korea's Financial Supervisory Service (FSS) immediately activated its highest-level emergency response mechanism. After receiving voluntary reports from the relevant institutions, regulators promptly formed a joint investigation team and launched an in-depth tracing of the IT defense architecture of the three institutions.

Because the data leaked by Daishin Securities directly involved extremely sensitive information such as credit scores, bank accounts, and asset records of tens of thousands of investors, the FSS urgently dispatched an on-site inspection team to the company on October 28, sealed server logs, and reviewed whether its identity verification gateways contained serious compliance defects.

Beyond case-specific forensics, the regulators' review has expanded across the entire industry. The FSS is conducting a sweeping audit of security baselines across South Korea's financial industry, brokerage networks, and licensed virtual asset service providers (VASPs), to prevent hackers from exploiting the same vulnerabilities or supply-chain malware to launch a second wave of large-scale lateral infection.

South Korean financial authorities have made clear that if subsequent investigations find financial institutions delayed reporting, failed to end-to-end encrypt customers' core information as required, or conducted security audits merely as a formality, they will impose the maximum administrative penalties and initiate executive accountability procedures in accordance with the law.

AI Weaponization Alarm: Simultaneous Multi-Point Hacking Attacks Becoming the 'New Normal'

In this security crisis, the most sobering issue for global financial and security communities is the stern warning issued by the Governor of South Korea's Financial Supervisory Service after the incidents. He clearly stated that as generative artificial intelligence is increasingly weaponized at scale by hacker groups, the power balance between offense and defense in cyberspace has been completely disrupted.

In the traditional hacking era, finding a zero-day vulnerability deep within complex financial systems often took senior hackers weeks or even months of reverse engineering; however, advanced AI penetration agents have compressed code flaw detection, fuzzing, and automatic attack payload generation to a matter of minutes.

Senior regulators particularly emphasized that the avalanche-like decline in attack costs means that 'multiple attacks against heterogeneous financial systems erupting simultaneously' will become the new normal. When attackers possess vast automated AI penetration tools, any traditional financial institution still relying on static rule sets and manual investigation is effectively defenseless.

To this end, South Korea's Financial Supervisory Service issued an ultimatum to the boards of financial institutions across South Korea, urging senior management to treat building IT security capabilities as a core governance issue vital to survival, completely abandon the outdated notion of cybersecurity as a compliance cost center, and take primary responsibility for protecting customer assets, information security, and financial trust.

Reconstructing the Attack-Defense Paradigm: Lessons in Self-Rescue Through Collaborative Defense Between Web3 and Traditional Finance

This series of attacks spanning crypto exchanges and major brokerage and asset management firms has sounded a deafening alarm for the global digital financial ecosystem. It vividly demonstrates that, in the face of modern advanced persistent threats (APTs) and AI-hybrid attacks, traditional finance and Web3 virtual asset institutions have long been in the same fragile cyber trenches.

In particular, cryptocurrency exchanges often invest heavily in on-chain smart contract audits, yet can leave fatal vulnerabilities in seemingly peripheral Web2 links such as internal mobile collaboration tools, single sign-on (SSO), and employee mobile devices. The attack path in which hackers use office systems as a springboard to penetrate core business operations is becoming the industry's most dangerous gray rhino.

Facing the AI-powered evolution of attack tools and the increasing frequency of attacks, the only way for financial institutions to break through is to comprehensively upgrade their defense systems to AI-driven dynamic zero-trust architectures. From millisecond-level intent recognition of abnormal office behavior to minimized credential isolation, only fully automated circuit breaking at the moment an attack begins can defend against new types of penetration.

As the investigation by South Korean regulators deepens, the security storm triggered by three institutions is likely to give rise to stricter statutory cybersecurity standards for finance and crypto assets. For all institutions managing massive capital and user data in the digital world, this ordeal is also a profound reshaping of security awareness and governance responsibility.

Source: TechFlow