Bithumb, South Korea’s largest digital currency exchange, was hacked, and billions of won of users’ funds disappeared

Bithumb, South Korea’s largest Bitcoin and Ethereum exchange, was recently hacked, with users losing billions of won.

According to data, Bithumb's daily Bitcoin trading volume exceeds 13,000 BTC, making it one of the world's top five Bitcoin exchanges, accounting for nearly 75.7% of the trading share in the Korean Bitcoin market.

At the same time, the exchange is currently the world's largest Ethereum (ETH) trading market.

According to local media outlet Kyunghyang Shinmun, the hack occurred late last week and caused Bithumb customers to lose billions of won worth of funds, with one victim claiming that 10 million won worth of Bitcoin from his account “disappeared in an instant.”

Hackers managed to gain access to the personal information of nearly 31,800 Bithumb users, including their names, phone numbers, and email addresses. The exchange claims that this number represents approximately 3% of its customers.

Bithumb discovered the attack on June 29 and alerted the authorities on June 30. In addition, more than 100 Bithumb customers have submitted complaint letters to the Cyber ​​Crime Reporting Center of the Korean National Police Agency.

Although Bithumb admitted that the theft occurred on its website, it believes that the hackers did not directly access the funds stored on the exchange. However, many customers reported that their digital wallets had been emptied. The exchange also claimed that the theft was related to the personal computer of an employee of the exchange, rather than a problem with the exchange's internal network, servers or digital wallets.

"It was the employee's personal computer that was hacked, not the company's main server. Some users' personal information such as mobile phones and email addresses were leaked. However, some customers also suffered theft due to the leakage of one-time passwords."

- Bithumb

As for how the funds in the victims’ accounts were specifically stolen, one victim told reporters that the attackers seemed to have sufficient credentials to conduct a “voice phishing” process, in which the scammers pretended to be representatives of Bithumb when calling the victims.

One victim claimed that the attacker posed as a Bithumb manager and said in a phone call that he suspected hacker transactions abroad, and instructed the victim to give him a Bithumb identification number. This one-time password granted the attacker immediate access to the victim’s account and stole 10 million won worth of Bitcoin (about $8,700).

The exchange posted a notice on its website stating that "the exchange has decided to compensate the victims of this personal information leak," and the company said that they will pay up to 100,000 Korean won (currently worth $87) to each victim. Further compensation will be paid as soon as all losses are confirmed.

The exchange also claimed that they had reported the hack to three separate agencies, including the Korea Communications Commission, the Korea Internet and Security Agency (KISA), and the Supreme Prosecutor’s Office. However, the Herald reported on Monday that about 100 victims will file a class-action lawsuit against Bithumb.

It is unclear whether Bithumb will be legally responsible for the lost funds, a situation complicated by the lack of regulation of digital currencies in South Korea.

The Korea Herald reported that Park Yong-jin, a member of the Democratic Party of South Korea, is preparing a series of draft bills to give legal status to cryptocurrencies (including Bitcoin and Ethereum) by amending the Electronic Financial Transactions Act. Recently, Japan completed a similar process, legalizing Bitcoin payments on April 1.