Bithumb has been fined $136,000 for illegally transferring customer data to foreign exchanges.
South Korea's Personal Information Protection Commission (PIPC) has ruled to impose a fine of 210 million won (approximately $136,000) on the cryptocurrency exchange Bithumb. The reason was a violation of procedures for processing and transferring users' personal data to foreign companies without obtaining proper consent.
The scale of the violations was significant: from September to November 2025, Bithumb transmitted order book information for trading pairs involving USDT. The exchange claimed the data was being sent to the Stellar platform, but in reality, it was being directed to an exchange operated by BingX. This constitutes a direct breach of client trust and regulatory requirements.
Additionally, the PIPC identified systematic violations in data transfers to 13 other foreign cryptocurrency exchanges. Bithumb transmitted user names, dates of birth, and wallet addresses without the full consent of the owners. Such practices jeopardize the privacy and security of millions of traders.
The regulator demanded that Bithumb immediately review and rectify its data transfer protocols. The authority emphasized that the cross-border movement of personal information must strictly comply with the law, and the rights of data subjects must be protected at all stages.
New Rules for Blockchain Companies
Simultaneously with the fine, the PIPC issued guidelines for blockchain companies, taking into account the unique features of the technology: transparency and the inability to delete records. The regulator strongly recommended against placing personally identifiable information, such as names or social security numbers, on-chain. This is an important step toward balancing innovation with privacy protection.
As a reminder, on June 11, the PIPC imposed a record fine of 624.6 billion won on the technology giant Coupang following a massive data leak. The current decision regarding Bithumb is a signal to the entire industry: the regulator is tightening control, and ignoring requirements could prove costly. As an analyst, I believe exchanges must immediately implement strict consent and data transfer audit protocols to avoid reputational and financial losses.