Korea's Biggest Bitcoin Exchange "Bithumb" Hack Leads to Millions in Bitcoin Losses

The largest bitcoin and ether exchange in South Korea by volume, Bithumb, was recently hacked. Monetary losses from compromised accounts have started to surface, and are quickly reaching into the billions of won.

A cyberattack targeting Bithumb, South Korea’s largest bitcoin and ethereum exchange by trading volume, has resulted in the loss of personal data belonging to an estimated 31,000 users, or 3% of its members. Bithumb is one of the five largest bitcoin exchanges in the world and hosts over 13,000 bitcoins worth of trading volume daily, or roughly 10 percent of the global bitcoin trade.

While admitting to being hacked on their website, Bithumb maintained that there was no direct access to funds stored on the exchange. Nonetheless, many customers are reporting their digital currency wallets being emptied. The exchange further claims that the breach was made to a personal computer belonging to an employee, and not the exchange’s internal network, servers nor digital currency wallets. While victim accounts of exactly how their funds were stolen have widely differed, attackers appear to have stolen enough credentials to begin a process of “voice phishing,” where the scammers call up victims one at a time and pose as representatives of Bithumb.

One victim claims that the attacker posed as an executive at Bithumb and phoned to say that he was "suspicious of a foreign hacking transaction,” and instructed his victim to give him an “identification number written on the letter from Bithumb.” The number in question was the victim’s One-Time Password, (OTP) which granted the attacker immediate access to ten million won, worth about US$ 8,700.

Such cases organizations should emphasize the need for businesses to have clearly defined security policies and procedures around the use of personal devices for work purposes and the re-use of passwords; For e.g.: Employees should not be using their work passwords for personal use. Instead of waiting for something to happen at the extreme levels, businesses should consider investing in technical security layers, from threat intelligence solutions to two factor authentication—which would surely have helped in this matter.