Loading story…
South Korean cryptocurrency exchange Bithumb mistakenly credited customers with roughly 620,000 BTC (reported at ~$40B–$44B) after an internal system/configuration error during a promotional payout intended to distribute small rewards of about ₩2,000 (~$1.40). The error reportedly resulted in ~695 accounts receiving outsized balances (in some cases ~2,000 BTC per account), briefly disrupting the exchange’s order books and causing a sharp, short-lived BTC price dislocation on Bithumb (reported at roughly a 17% drop versus other markets).
Bithumb stated the incident was not a hack or external breach and said customer assets remained secure. The exchange reported it detected the issue quickly and restricted trading and withdrawals on affected accounts within about 35 minutes, recovering ~99.7% of the mistakenly credited bitcoin; some recipients reportedly sold portions before controls were applied, contributing to the temporary price impact. Bithumb said it would implement follow-up measures to prevent recurrence, including improved verification and monitoring controls.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-13, the Bank of Korea said crypto exchanges should adopt safeguards similar to stock-market circuit breakers after the Bithumb payout error. The central bank cited weak internal controls, poor supervisory approval, and a malfunctioning fraud-detection system, and recommended real-time ledger-to-blockchain reconciliation and trading halts during abnormal transactions or sharp price swings.
On 2026-04-09, Bithumb moved to freeze seven bitcoin through a local court as a pre-lawsuit measure tied to the February payout error. The exchange said months of recovery efforts had reduced the outstanding amount to seven BTC, and a civil unjust-enrichment case was expected to follow.
On 2026-04-06, South Korea’s Financial Services Commission directed domestic crypto exchanges to reconcile internal ledgers with actual holdings every five minutes, after finding weak reconciliation practices and flaws in trade-halting mechanisms. The regulator also ordered daily publication of asset-matching balances, monthly external verification by accounting firms, and completion of the new system by the end of May.
On or around 2026-02-11, the governor of South Korea's Financial Supervisory Service publicly urged stronger regulatory mechanisms to prevent similar incidents. He specifically highlighted the need to address crypto 'naked selling' risks if digital assets are to be treated more like traditional financial instruments.
By 2026-02-11, Bithumb said it would compensate traders affected by the exchange's internal bitcoin price plunge by paying the difference plus a 10% bonus. The announcement came as scrutiny grew over the exchange's ability to create temporary synthetic balances beyond its actual holdings.
Following the Bithumb error, South Korean financial authorities held emergency discussions and said the incident exposed weaknesses in crypto-exchange controls. Regulators signaled possible on-site inspections or searches if further irregularities are found.
Shortly after the Feb. 6 incident, Bithumb said it had recovered 99.7% of the mistakenly issued bitcoin, while continuing to track the remainder that had been sold, converted, or withdrawn. The exchange also indicated it could pursue legal action against users who do not return the funds.
Within about 35 minutes of detecting the mistake on 2026-02-06, Bithumb restricted trading and withdrawals on affected accounts and moved to reverse the false balances. The exchange later said the incident was an internal operational error, not a hack, and that customer custody remained secure.
On 2026-02-06, Bithumb mistakenly set a promotional payout in bitcoin instead of Korean won, incorrectly crediting about 620,000 BTC across 695 customer accounts. The error caused a sharp temporary dislocation on Bithumb, with its BTC/KRW price falling roughly 17% versus other markets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
8 references tracked. Mallory keeps watching after this page renders.
koreatimes.co.kr
Open sourcecoindesk.com
Open sourcebiz.chosun.com
Open sourcekoreatimes.co.kr
Open sourcetomshardware.com
Open sourcescworld.com
Open sourcehackread.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Bithumb is pressing ahead with a proposal to renew CEO **Lee Jae-won** for another two-year term at a March 31 shareholder meeting, even as the South Korean crypto exchange faces escalating regulatory scrutiny over compliance failures and operational lapses. Authorities have already imposed a six-month partial business suspension, a **36.8 billion won** fine, a reprimand warning for Lee, and a six-month suspension for the company’s reporting officer over anti-money laundering violations. Regulators are also investigating Bithumb’s order book sharing arrangement with Australia-based **Stellar Exchange** and a Feb. 6 bitcoin overpayment incident that reportedly credited users with roughly 15 times more bitcoin than the exchange actually held. The **Financial Supervisory Service** and **Financial Intelligence Unit** are reviewing the glitch for possible violations of the **Virtual Asset User Protection Act** and financial transaction reporting laws, raising the prospect of further penalties as Bithumb also seeks renewal of its virtual asset service provider license.
Jun 29, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
Bitcoin Depot disclosed that attackers breached parts of its corporate IT environment and stole **50.903 BTC**—worth about **$3.665 million**—from company-controlled wallets after obtaining credentials tied to digital asset settlement accounts. The company said it detected suspicious activity on March 23, activated incident response procedures, brought in external cybersecurity experts, and notified law enforcement after the unauthorized transfers had already occurred. The company reported that the intrusion was contained to its corporate systems and did **not** affect customer platforms, customer data, or other environments. Bitcoin Depot later determined the incident was material because of potential reputational, legal, regulatory, and response-related impacts, adding to broader scrutiny of security in the crypto ATM sector following earlier breaches involving Bitcoin Depot and rival operator Byte Federal.
Jun 29, 2026