Bithumb boosts security spending 2.6 times, but Korea flags a 6,444-customer data leak

Bithumb has spent more on information security and hired far more dedicated security staff over the past five years, yet a leak through its internal mobile groupware has put the effectiveness of that spending under the microscope. For high-risk operators, the useful bit is not the budget number itself, but the gap between stronger controls on paper and a breach in an employee-facing system.

1. According to information protection disclosures from the Korea Internet & Security Agency (KISA), Bithumb’s information security spending rose from 4,683,010,000 won in 2020 to 12,369,200,000 won last year, about 2.6 times higher. Last year’s spending was also about 30% above the finance and insurance sector average of roughly 9.5 billion won.
2. Bithumb’s dedicated security staff expanded from 10 in 2020 to 31 in 2024 and 42 last year. That included 35 in-house security employees and 6 outsourced staff last year, with dedicated information security personnel making up 10.7% of total IT staff, above the 6.8% average across corporations.
3. On the 27th, Bithumb said it confirmed that an unauthorized external party accessed Dowoffice, its in-house mobile groupware, and illegally took out personal information and files. The company said 6,444 customers were affected by the leak.
4. Bithumb said personal information for 5,600 of the affected customers was not exposed because it was stored in encrypted files that could not be accessed externally. The number of customers whose personal information was exposed was 844.
5. The leaked items include names, mobile phone numbers, email addresses, resident registration numbers, driver’s license numbers, account numbers, and copies of IDs, with the scope varying by customer. The information of 715 Bithumb executives and employees was also leaked.

Bithumb has maintained security certifications including the Information Security and Personal Information Protection Management System (ISMS-P), but the incident hit an internal employee tool rather than the exchange’s core transaction system. That distinction matters: for PSPs and platforms in high-risk verticals, the failure mode is often not the payment engine itself, but the side door nobody put enough weight on.