Loading story…
Bithumb is pressing ahead with a proposal to renew CEO Lee Jae-won for another two-year term at a March 31 shareholder meeting, even as the South Korean crypto exchange faces escalating regulatory scrutiny over compliance failures and operational lapses. Authorities have already imposed a six-month partial business suspension, a 36.8 billion won fine, a reprimand warning for Lee, and a six-month suspension for the company’s reporting officer over anti-money laundering violations.
Regulators are also investigating Bithumb’s order book sharing arrangement with Australia-based Stellar Exchange and a Feb. 6 bitcoin overpayment incident that reportedly credited users with roughly 15 times more bitcoin than the exchange actually held. The Financial Supervisory Service and Financial Intelligence Unit are reviewing the glitch for possible violations of the Virtual Asset User Protection Act and financial transaction reporting laws, raising the prospect of further penalties as Bithumb also seeks renewal of its virtual asset service provider license.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Bithumb is expected to hold a shareholder vote on March 31 to decide whether Lee Jae-won will receive a new two-year term as CEO. The vote comes amid fallout from the bitcoin glitch and unresolved regulatory issues.
Despite the sanctions and ongoing investigations, Bithumb moved forward with a proposal to renew CEO Lee Jae-won's term. The decision drew scrutiny because the company was also under pressure to renew its virtual asset service provider license.
Following the overpayment incident, the Financial Supervisory Service and Financial Intelligence Unit began examining the case for possible violations of the Virtual Asset User Protection Act and financial transaction reporting laws. Regulators were also continuing a separate review of Bithumb's order book sharing arrangement with Australia-based Stellar Exchange.
On Feb. 6, Bithumb mistakenly credited users with bitcoin amounts reportedly about 15 times greater than the exchange's actual holdings. The incident exposed serious weaknesses in the company's internal verification, asset management, and operational controls.
South Korea's Financial Intelligence Unit imposed a six-month partial business suspension on Bithumb, fined the exchange 36.8 billion won, issued a reprimand warning to CEO Lee Jae-won, and suspended its reporting officer for six months over AML compliance failures. The exact sanction date is not specified in the references, but it had already occurred before the later February bitcoin incident and March board actions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean cryptocurrency exchange **Bithumb** mistakenly credited customers with roughly **620,000 BTC** (reported at **~$40B–$44B**) after an internal **system/configuration error** during a promotional payout intended to distribute small rewards of about **₩2,000 (~$1.40)**. The error reportedly resulted in **~695 accounts** receiving outsized balances (in some cases **~2,000 BTC per account**), briefly disrupting the exchange’s order books and causing a sharp, short-lived **BTC price dislocation on Bithumb** (reported at roughly a **17%** drop versus other markets). Bithumb stated the incident was **not a hack or external breach** and said customer assets remained secure. The exchange reported it detected the issue quickly and **restricted trading and withdrawals** on affected accounts within about **35 minutes**, recovering **~99.7%** of the mistakenly credited bitcoin; some recipients reportedly sold portions before controls were applied, contributing to the temporary price impact. Bithumb said it would implement follow-up measures to prevent recurrence, including improved verification and monitoring controls.
Jun 29, 2026
South Korean police arrested two suspects over the alleged embezzlement of **22 BTC (~$1.5M)** that had been held in police custody after a virtual asset company turned over a cold wallet during a 2021 hacking investigation. Reporting indicates required procedures to move seized crypto into a police-controlled cold wallet and vault were not followed; instead, the original third party retained control elements and later allegedly provided a **mnemonic seed phrase** to a hacker as part of a purported “loan” arrangement, enabling the attacker to recover the wallet and transfer the funds without police detection. The theft was reportedly uncovered during a National Police Agency audit triggered by a separate January 2026 incident in which **320 BTC** went missing from the Gwangju District Prosecutors’ Office. Separately, the U.S. Department of Justice announced the seizure of **$61 million in USDT (Tether)** tied to **“pig butchering”** cryptocurrency investment scams, stating the funds were traced to addresses used to launder proceeds stolen from victims. The DoJ described typical scam mechanics involving social engineering via dating/social messaging apps, coercion of trafficked workers in Southeast Asia–based scam compounds, and fraudulent investment platforms that display fabricated returns and impose additional “fees” when victims attempt withdrawals, with law enforcement emphasizing cross-border tracing and disruption of laundering infrastructure.
Jun 29, 2026
The U.S. Treasury designated **Xinbi Guarantee** a significant transnational criminal organization for operating a Chinese-language marketplace that allegedly enabled Southeast Asian cyber-scam syndicates, cryptocurrency investment fraud, money laundering, and sales of stolen data, forged documents, deepfake tools, and cash-out services. Xinbi reportedly used escrow-backed transactions and processed more than **$36 billion** since about 2022; U.S. officials also alleged links to North Korean hackers and other criminal groups. The Justice Department’s Scam Center Strike Force seized Xinbi-linked Telegram infrastructure and digital-asset wallets under a federal court order, while prosecutors restrained **$52 million** in cryptocurrency and OFAC listed 52 associated TRON addresses. OFAC also sanctioned Cambodia-based Anwen Technology, tied to the XinbiPay/NewPay wallet, and Singapore-based SafeW Technology, developer of an encrypted messaging app, for allegedly supporting Xinbi; Telegram banned the marketplace. Separately, U.S. and Malagasy authorities shut 13 alleged scam centers, arresting 500 people, as the U.S. reported restraining $938 million connected to related crypto-scam schemes.
Sep 12, 2026