API hacks are putting South Korea crypto exchange users on alert as Upbit, Bithumb and DigitalX roll out AI trading tools

South Korea’s virtual asset exchanges are pushing AI-assisted trading services, but the same API (application programming interface) plumbing that makes those tools work also creates an obvious attack surface. For high-risk operators, the takeaway is simple: if you expose APIs, you need tighter key handling, permission controls, and withdrawal approval flows.

1. According to the virtual asset industry on the 7th, Upbit supports an AI automated trading service under Upbit Skill, Bithumb offers AI Trade Kit, and DigitalX, formerly Korbit, introduced an AI service to its app on the 6th. These services let users build an automated trading setup without coding knowledge.
2. An AI agent is described as software that can infer situations, make plans, and execute them through external tools or systems without outside intervention. In practice, that means a user can ask for tasks such as checking virtual asset prices, viewing balances, or placing a market buy in everyday language, and the AI agent can suggest the command setup or carry out the transaction.
3. The security issue is not abstract. The article says hacking through APIs mainly happens when a user’s API key is leaked or stolen. It also notes a 2022 court finding that the leak of a Bithumb user’s API key was the individual’s responsibility, which is a useful reminder for exchanges and PSPs that liability can land with the end user unless permissions and controls are clearly set up.
4. The risk goes up further when users rely on automated trading bot source code shared online. The article warns that a hacker can hide malware in the code, steal the user’s API key after download, and then misuse the account to misappropriate assets.
5. Experts recommend configuring permissions so the user must approve final actions such as withdrawals or trade execution. For exchange operators and payment providers serving high-risk flows, that is the part that matters most: not whether the API exists, but whether the API can be constrained before it becomes a clean path to asset theft.

The practical point for the high-risk crowd is that AI trading features are only as safe as the permissions around them. If an API key can move funds without a second check, it can also move them out.