Bithumb fined $136,000: South Korean regulator cracks down on illegal transfer of user data
The Personal Information Protection Commission of South Korea (PIPC) has imposed a fine of 210 million won — approximately $136,000 — on the cryptocurrency exchange Bithumb. The reason is the transfer of users' personal data to foreign companies without proper consent.
My sources indicate that violations were recorded between September and November 2025. Bithumb transmitted information from the order book for trading pairs with USDT. However, the key issue was a discrepancy between the stated recipient and the actual one.
The exchange obtained permission from clients to transfer data to the Stellar platform, but in reality, it sent it to a platform managed by BingX. This is a direct violation of the principles of transparency and fairness in processing personal information.
The regulator also identified violations in transfers to 13 other foreign exchanges. Bithumb transmitted users' names, dates of birth, and wallet addresses without obtaining full and explicit consent for these actions. For the crypto industry, where anonymity and confidentiality are critical, such an approach is unacceptable.
The PIPC demanded that Bithumb immediately review and correct its data transfer protocols. The authority emphasized that cross-border movement of personal information must strictly comply with the law, and the rights of data subjects must be protected at all stages.
In parallel, the PIPC issued guidelines for blockchain companies, taking into account the technology's features: transparency and the inability to delete records. The regulator recommended not to include on-chain data that could identify individuals, such as names or social security numbers. This is a reasonable step that could become a standard for the entire industry.
This is not the first time South Korean regulators have demonstrated a tough stance on data breaches. I recall that previously, the PIPC imposed a record fine of 624.6 billion won on the tech giant Coupang after a massive leak. For cryptocurrency exchanges, this is a signal: neglecting user data protection comes at a high cost.
My expert opinion: This case is a wake-up call for all crypto platforms working with international partners. The fine itself is small for Bithumb, but the reputational damage and increased scrutiny from the PIPC could have more serious consequences. The market is moving toward the standards of traditional finance, and exchanges will have to invest in compliance to avoid such sanctions in the future.