On October 27, 2026, a "side breach" that occurred at the backend of the screen tore through Bithumb's internal defenses - unauthorized external personnel gained abnormal access to DaouOffice, the mobile collaboration/office system used by this South Korean exchange. Unlike what users might intuitively think of as "the exchange being hacked," this attack did not directly target the matching engine or wallet systems, but rather hit the office entry point where employees handle customer identity information on a daily basis. According to reports from multiple media outlets, Bithumb later released an announcement stating that this abnormal access involved a total of 6,444 customer data being touched, with about 5,600 individuals' data in an encrypted state, making it impossible for attackers to read specific content directly. However, personal information of 844 customers was confirmed to have leaked in a readable form. Even more jarring is that this was not an incident limited to the "user side"; sensitive identity data such as names, phone numbers, email addresses, and even resident registration numbers of approximately 715 employees and partner personnel were also included in the affected range. On October 29, Bithumb publicly reported the event's developments, using a layered disclosure method to differentiate between "data being accessed" and "information readable and leaked," attempting to emphasize that the core trading and asset systems were not compromised. However, in the context where the crypto industry has long regarded "security" as a brand foundation, the exposure of weaknesses in internal office and identity information management by a leading platform is sufficient to shake external evaluations of its overall security image, forcing users to reassess the trust boundaries of entrusting personal information to such platforms.

6,444 people and 844 people: The numerical divide of the disclosure

In Bithumb's announcement, "involved 6,444 people" and "leaked 844 people" are not two contradictory figures, but rather the split results of the same event under different statistical criteria. The 6,444 represents the total population whose data was accessed or involved in the incident, among which about 5,600 individuals' information is in an encrypted state; although the attackers touched this portion of the data, they could not read specific content directly. The remaining 844 individuals were clearly classified as "personal information leaked in a readable form," which is the group that Bithumb confirmed suffered substantial privacy harm in the announcement.

This layered disclosure logic essentially separates "data accessed" and "readable information leaked" into two matters: the former emphasizes the breadth of the incident's impact, while the latter highlights the depth of privacy risk. For the platform, emphasizing that "the vast majority of data is still unreadable" can somewhat mitigate external intuitive impressions of a severe data breach. For the media, a title arrangement like "6,444 people affected, among which 5,600 people's information is unreadable, and 844 people's information was leaked" translates the technical details into risk differences that readers can more easily perceive by highlighting the comparison between large and small numbers. However, from the user's perspective, the boundary of whether they are counted among the "6,444" or "844" is not clear; this numerical divide objectively retains an interpretive space for the platform, yet also creates a significant dislocation in the perceived severity of the event between "technical metrics" and "intuitive understanding."

Internal collaboration tools become the breach point: Security boundaries torn from the side

If one traces back along this numerical divide, one will find that the attackers did not directly assault the matching system or asset custody layer, but rather cut in from a more concealed flank - on October 27, 2026, the system that was abnormally accessed was DaouOffice, the mobile collaboration system used by Bithumb for internal communication and office management. This system is nominally just an "office tool," yet it plays a role in identity information management and maintaining contact channels, involving clients and about 715 employees and partner personnel in the incident, indicating that its node density in the internal data topology far exceeds general impressions.

In the security architecture of crypto enterprises, transaction engines and hot wallets are often viewed as "fortresses," receiving the most protective resources, while collaboration platforms like DaouOffice are positioned in a gray area: they connect to the company account system and often link up with customer data and employee personnel information for notifications, approvals, and service follow-ups, yet they are not intuitively perceived by the public as "critical systems." Public information regarding this incident shows that the attack surface concentrated on office and identity information management, with no indication that core trading systems were breached. However, it is precisely this "non-core" positioning that makes internal tools linked to names, phone numbers, email addresses, and even resident registration numbers an ideal breach point - as long as read permissions are obtained at this level, attackers can bypass asset defenses, directly ripping open the security boundaries connected to client and employee relationship chains.

Identity information exposure risk: A trust test for South Korean exchanges

From the disclosed metrics, the 6,444 individuals whose data were accessed or involved in the leak are not abstract "account entries," but directly relate to real-world identity aspects. Potentially touched information types include names, phone numbers, email addresses, and even resident registration numbers. Among them, the personal information of 844 customers has been confirmed to have leaked in a readable form, while the data of about 5,600 individuals, although described as "in an encrypted state, content unreadable," are still recorded within the range accessed by the attackers. In South Korea, resident registration numbers themselves are highly sensitive identity identifiers, and once confirmed to be leaked, they typically trigger strict data protection and compliance responses. This also makes the public particularly sensitive to descriptions involving "potentially related information."

More challenging is that, even if most data is in an unreadable encrypted state, real-world risks do not diminish to zero as a result. Once attackers hold names, contact information, and the fact of whether someone is a Bithumb customer, they can accurately construct phishing emails, scam phone calls, and fake customer service scenarios. The presence of encrypted fields may also provide clues for user segmentation and profiling. This incident also affected 715 employees and partner personnel, with internal relationship chains equally exposed to potential social engineering attack surfaces. Although the asset system was not breached, which cannot be directly interpreted as a precursor to financial loss, for local users in South Korea, a trading platform that cannot even safeguard its internal office and identity information management means that compliance and security commitments need to be reassessed. This information leak occurring in the "backend system" will long remain a shadow in assessing the security culture of the exchange.

After the incident report: Questions Bithumb must address

From the timeline, this event was not "immediately public." On October 27, unauthorized external personnel abnormally accessed Bithumb's internal mobile collaboration system DaouOffice, triggering a data security incident; until October 29, Bithumb publicly released a report focusing on disclosing the attack entry, number of affected individuals, and the layered metrics of about 5,600 individuals' data being unreadably encrypted and 844 individuals' information confirmed leaked in readable form. During these two days, the internal processes evidently involved checking and statistics, but the announcement still left key details blank: Who were the attackers, what technical paths did they use to breach defenses, and where were the specific vulnerabilities? The report did not cover these points at all and can only be categorized as "unknown territory."

What external observers are even more concerned about is the absence of actions regarding compliance and user protection. The publicly available materials do not specify whether Bithumb has formally reported to the relevant South Korean regulatory bodies, nor did it provide a timetable for any remediation or compensation plans, only describing "affected population and data status" from a macro level without clearly stating whether affected customers and 715 employees and partner personnel have been notified one by one or if they can receive targeted support. In subsequent processes, the market will have to continue asking: Will Bithumb supplement technical reviews and post-incident rectification paths? When will it institutionalize regulatory communication and user notification as a clear commitment? And is it willing to rebuild the trust gap torn open by this office system intrusion using transparency and accountability boundaries?

A wake-up call for the industry: The soft spot in the security stack of crypto enterprises

The real wake-up call this incident delivers is that the attack surface is not in the traditional "core systems" like transaction matching or wallet custody, but in the internal mobile collaboration/office platform DaouOffice, which has long been seen as auxiliary infrastructure. Office systems that integrate functions such as HR, customer service, and operations management naturally gather a large amount of real-name information and contact methods, and if authority configurations, data distribution, and access audit designs are weak, they can become the best breakthrough point to bypass the trading system's defensive line. This incident involved a total of 6,444 customers and approximately 715 employees and partner personnel, indicating that the concentration and leakage radius of identity data at the office level are sufficient to tear through an exchange's credibility boundary without any on-chain asset loss.

For a long time, the crypto industry has preferred to pile security resources into the protection of on-chain assets, matching engines, and risk control models while categorizing collaboration tools, customer service backends, and HR systems as "non-core business." Bithumb's experience exposes the vulnerability of such "uneven investment in the security stack": as long as the office entry is pried open, attackers have the opportunity to conduct deeper social engineering attempts using employee identities and customer information. For other institutions, what is truly worth observing next is not merely repeating calls to "emphasize security," but whether they will systematically review the permission paths and logging mechanisms of similar collaboration platforms, tighten the collection and retention of sensitive fields such as resident registration numbers, promote data minimization and encrypted storage, and integrate office systems into routine penetration tests and emergency drills. This will become a key variable in measuring whether the industry truly learns from Bithumb's lessons.

Join our community, let's discuss and become stronger together!
Exclusive Hyperliquid benefits for AiCoin: https://app.hyperliquid.xyz/join/AICOIN88
Exclusive Aster benefits for AiCoin: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。