Three Korean Financial Institutions Including Bithumb Hacked: Nearly 40,000 Customer Records Leaked, Regulators Launch Investigation

Author: TechFlow

TechFlow Summary: South Korea’s financial and crypto-asset sector is undergoing a highly cautionary coordinated cybersecurity attack. On October 28, authoritative media confirmed that South Korea’s second-largest cryptocurrency exchange Bithumb, leading asset management giant Mirae Asset, and established brokerage Daishin Securities have all confirmed suffering malicious penetration and data exfiltration by external hackers.

Daishin Securities has confirmed that the sensitive personal and credit data of nearly 40,000 clients were stolen, while Bithumb’s internal mobile office collaboration network was also illegally breached. It is currently urgently verifying whether member trading information has been compromised. Following the incident, South Korea’s highest financial regulator, the Financial Supervisory Service (FSS), swiftly dispatched a specialized on-site inspection team to conduct penetrating audits.

Regulatory authorities also issued an unprecedented high-level security alert, pointing out that artificial intelligence technology has been deeply weaponized by hacker groups for vulnerability mining and automated penetration, accelerating the exposure of flaws in the financial system. This not only signals the collapse of traditional passive defense systems but also triggers a systemic alarm across global finance and Web3 infrastructure in the fight against the malicious evolution of AI.

Cascading Compromises: Crypto Giants and Traditional Brokerages Hit by External Penetrations

This cybersecurity black swan sweeping through South Korea’s financial sector first tore open a rift between traditional brokerages and leading crypto platforms. According to the original report from Yonhap News Agency, Daishin Securities officially announced on October 28 that the personal information and key credit records of 38,490 clients were stolen by external hackers.

Lighting up red flags at the same time as Daishin Securities was South Korea’s second-largest crypto exchange, Bithumb. Bithumb’s internal monitoring system detected abnormal traffic on October 27, confirming that its mobile office collaboration system had been illegally accessed by unauthorized external entities, resulting in the leakage of some internal sensitive data.

Bithumb is currently on high alert, with its technical team working closely with external security experts to rigorously trace the attack paths. The core focus of official assessments is whether the compromise of the collaboration system has further horizontally penetrated into its core member database and on-chain wallet management system.

Meanwhile, Korea’s top fund management institution, Mirae Asset Global Investments, was also confirmed to be hit during this wave of attacks. The successive compromises of three institutions holding core positions across different financial sectors suggest that hackers likely orchestrated an organized, coordinated strike targeting South Korea’s financial supply chain.

Swift Regulatory Intervention: Financial Supervisory Service Deploys Teams and Launches On-Site Penetrating Inspections

In response to this major security incident that could shake trust in financial markets, South Korea’s Financial Supervisory Service (FSS) quickly activated its highest-level emergency response mechanism. Upon receiving voluntary reports from the involved institutions, regulators promptly formed a joint investigation team to conduct deep tracing of the IT defense architectures across the three organizations.

Because the leaked data from Daishin Securities directly involves highly sensitive information such as credit scores, bank account numbers, and asset records for tens of thousands of investors, the FSS immediately dispatched an on-site inspection team to the company on October 28. The team fully secured server logs and verified whether its authentication gateways contain severe compliance vulnerabilities.

Beyond individual case evidence collection, regulatory inspections have expanded across the entire industry. The FSS is conducting a comprehensive baseline security sweep of the entire South Korean financial sector, brokerage networks, and licensed virtual asset service providers (VASPs), strictly preventing hackers from exploiting the same vulnerabilities or supply chain malware to launch a second wave of large-scale lateral infections.

South Korean financial authorities made it clear that if subsequent investigations uncover derelictions of duty by financial institutions—such as delayed reporting, failure to end-to-end encrypt core client information as required, or superficial security audits—they will initiate maximum administrative penalties and executive accountability procedures in accordance with the law.

The AI Weaponization Alarm: Multi-vector Hacker Attacks Trend Toward a “New Normal”

In this security crisis, what most profoundly concerns the global financial and cybersecurity communities is the solemn warning issued by the head of the South Korean FSS after the incident. He explicitly pointed out that the power balance across both sides of cyber offense and defense has been completely shattered as generative AI is increasingly weaponized by hacker groups at scale.

In the era of traditional hacking, discovering a zero-day vulnerability at the core of complex financial systems often required senior hackers weeks or even months of reverse engineering; however, empowered by advanced AI-driven penetration agents, code flaw sniffing, fuzzing, and automated attack payload generation have been compressed to a matter of minutes.

Regulatory leadership specifically emphasized that the avalanche-like drop in attack costs means that "multiple concentrated attacks against heterogeneous financial systems occurring simultaneously" will become the new normal. When attackers possess massive fleets of automated AI penetration tools, any traditional financial institution still relying on static rulebases and manual screening is effectively helpless.

To address this, the South Korean FSS issued an ultimatum to the boards of directors of all domestic financial institutions, urging top management to treat IT security capacity building as a life-or-death governance priority, completely abandon the outdated mindset of viewing cybersecurity merely as a compliance cost center, and firmly shoulder the primary responsibility of protecting client assets, information security, and financial trust.

Rebuilding Offensive and Defensive Strategies: Self-Rescue Lessons from Collaborative Defense Between Web3 and Traditional Finance

This cascading attack spanning crypto exchanges and mainstream brokerage asset management has sounded a deafening alarm for the global digital finance ecosystem. It starkly proves that in the face of modern Advanced Persistent Threats (APTs) and hybrid AI attacks, traditional financial institutions and Web3 virtual asset entities have long been entrenched in the same fragile cyber warfare trench.

In particular, cryptocurrency exchanges tend to invest heavily in on-chain smart contract audits, yet easily leave fatal loopholes in seemingly peripheral Web2 chains such as internal mobile collaboration tools, Single Sign-On (SSO) systems, and employee mobile endpoints. The pathway where hackers use office systems as a springboard to penetrate core businesses is becoming the industry’s most dangerous gray rhino.

Facing the AI-ification of attack tools and the high-frequency pace of attacks, the only way for financial institutions to break through is to comprehensively upgrade their defense systems into AI-driven dynamic zero-trust architectures. From millisecond-level intent recognition for anomalous office behaviors to minimized credential isolation, only full automated circuit breakers triggered the instant an attack initiates can defend against novel intrusions.

As South Korean regulators delve deeper into the investigation, this security storm triggered by the three institutions is likely to catalyze more stringent statutory guidelines for financial and crypto-asset cybersecurity. For all institutions managing vast capital and user data in the digital world, this baptism serves as a profound reshaping of security awareness and governance responsibility.