Bithumb

Is Bithumb safe?

Bithumb is safer than its record suggests, because Korean law now protects the parts that matter most: your won sits in a separate account at KB Kookmin Bank, and most coins must be held offline. The exchange itself is the weak link. It has been hacked twice, and in February 2026 a staff typo credited users with 620,000 bitcoin it did not have.

We score Bithumb 58/100, below its rival Upbit and close to offshore exchanges such as Bybit. No customer has been left out of pocket by its incidents, but there have been too many of them.

The 620,000 bitcoin mistake

At about 7 pm on Friday 6 February 2026, Bithumb ran a small rewards event. The plan was to pay 249 users 620,000 won in total. An employee entered the amount in bitcoin instead, and those accounts suddenly showed about 620,000 BTC, worth tens of trillions of won.

Bithumb held about 42,000 bitcoin at the time. The extra coins existed only in its internal ledger, which tracks balances off-chain and at that point was reconciled against real wallets once a day (Upbit does it every five minutes). Some recipients sold before Bithumb froze the accounts, and the bitcoin price on the exchange briefly crashed.

Bithumb recovered 618,212 coins. Of the 1,788 that were sold, it recouped about 93% and covered the rest. It promised to repay customers who sold in the panic for their losses plus 10%, and gave every logged-in user 20,000 won.

Nobody hacked Bithumb, but the episode matters more than a typical outage. A single employee could create coins on the ledger with one entry. The Financial Supervisory Service upgraded its check into a full inspection within days, and Korea later required exchanges to match ledgers to real holdings every five minutes. Bithumb's own half-year report says its 2025 internal controls over financial reporting were not effective, and its auditor, Daehyun Accounting, recorded a material weakness in the event payout process.

Earlier hacks

• June 2018: Bithumb said about 35 billion won (around $31 million) of coins were stolen and that it would cover users' losses. It froze deposits and moved assets to cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary.
• March 2019: EOS and XRP worth roughly $13 to $19 million by outside estimates left its hot walletsHot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary. Bithumb said an internal review pointed to insiders and that only company funds were affected.

Under our rubric, repaid hacks sit between 60 and 79. Three serious incidents in eight years put Bithumb below that band, at 55.

The anti-money-laundering sanction

On 17 March 2026 Korea's Financial Intelligence UnitFinancial intelligence unitA national government agency that receives reports of suspicious transactions from banks and crypto firms and analyses them for money laundering.More in the glossary ordered a six-month partial suspension, blocking new customers from moving coins in or out, and a fine of 36,873.5 million won. Bithumb's filing lists the reasons: dealing with unregistered overseas exchanges, failures in customer checks and trading restrictions, missed suspicious-transaction reports, record keeping and risk assessment. The FIU also issued a reprimand warning to the chief executive and suspended a staff member for six months.

Bithumb sued, and the Seoul Administrative Court paused the suspension on 30 April 2026 until a final ruling. Upbit's similar but shorter suspension was cancelled by the same court, so the outcome is open. The FSS has also begun a separate sanctions procedure over the payout error.

What protects your money

Protection	Bithumb
Customer won	1.32 trillion won in a separate KB Kookmin account (30 June 2026)
Coins	Law requires at least 80% offline and the same coins held as owed
Hack reserve	70 billion won earmarked user-protection reserve
Accounts	Audited, filed publicly on DART

If Bithumb failed, the bank would repay won balances directly to customers. Coins have no deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary.

How to use Bithumb more carefully

1. Use an authenticator app and Bithumb's withdrawal address registration, and ignore calls asking you to move coins "for safety".
2. Do not trade into sudden price spikes or crashes on one exchange; the 2026 error showed internal prices can break away from the market.
3. Keep long-term coins in your own wallet.

How we scored it

Licensing (65) and custody (65) are Bithumb's strongest factors, mainly thanks to Korea's 2024 law. Legal record (45) is the weakest because of the FIUFinancial intelligence unitA national government agency that receives reports of suspicious transactions from banks and crypto firms and analyses them for money laundering.More in the glossary's fine and suspension. Security history (55) reflects two hacks and the payout error, all eventually covered by the company.