Bithumb

Bithumb has suffered at least three significant security incidents. In June 2018, attackers stole approximately $30 million in various cryptocurrencies. In March 2019, an insider attack — involving a rogue employee or contractor — resulted in approximately $13 million in losses. In September 2020, a suspected insider theft led to losses of around $25 million. In each case Bithumb covered the losses from its own funds and improved its security posture, but the repeated incidents significantly elevated its risk profile compared to exchanges with clean records.

Bithumb is registered with South Korea's Financial Intelligence Unit (KoFIU) as a Virtual Asset Service Provider (VASP) under the Act on Reporting and Using Specified Financial Transaction Information. KoFIU registration requires compliance with AML/KYC regulations and real-name verification requirements tied to domestic bank accounts. South Korea mandates that users of regulated exchanges link their trading accounts to verified Korean bank accounts to prevent anonymous transactions, which applies to all Bithumb users.

Bithumb is primarily a South Korean exchange and its core services are designed for KRW (Korean won) trading pairs. While international users can technically access the platform, real-name bank account verification — required for fiat deposits and withdrawals — is limited to Korean banks. This effectively restricts full functionality to South Korean residents. Non-Korean users face significant limitations on fiat on-ramp and off-ramp access. Bithumb does not operate under any foreign regulatory framework and does not actively market to users outside South Korea.

Following its multiple hack incidents, Bithumb significantly upgraded its security infrastructure. Measures include cold storage for the majority of customer assets, enhanced hot wallet controls with reduced balances, mandatory 2FA for all accounts, AML monitoring, real-name bank account verification, and improved internal access controls to reduce insider threat vectors. Despite these upgrades, the exchange's track record of repeated breaches means users should treat it as higher-risk compared to exchanges with no incident history, and should avoid storing large balances on the platform.

No. Bithumb does not currently publish a public proof of reserves report that would allow users to independently verify that their balances are backed 1:1 by real assets. KoFIU registration requires compliance with Korean financial reporting standards but does not mandate cryptographic reserve transparency. Users who want independent assurance that their funds are fully backed should look for exchanges that publish Merkle-tree PoR attestations audited by independent third parties. The absence of PoR is a notable gap given Bithumb's history of security incidents.