Bithumb hit with privacy fine over unauthorized overseas data sharing

The regulatory action follows an investigation into Bithumb’s order-book sharing practices between September and November 2025. While users had authorized data transfers to the Stellar exchange, the commission discovered that personal identifiers and order details were actually routed to systems operated by BingX. This discrepancy between the approved recipient and the actual destination triggered the breach of the Personal Information Protection Act.

Beyond order-book issues, investigators reviewed virtual asset transfers to 13 other international exchanges. Although Bithumb argued that sharing sender and recipient data—including names, wallet addresses, and birth dates—was necessary for anti-money laundering compliance, the commission maintained that such cross-border activities must still adhere to strict notice and consent protocols. The exchange is now under a corrective order to overhaul its international transfer procedures and clarify its data processing policies.

This penalty arrives amid a broader crackdown on Korean cryptocurrency exchanges. The commission simultaneously issued new guidelines for blockchain services, warning firms to minimize identifiable data stored on public ledgers. These standards reflect a growing focus on integrating privacy protections into the initial design of decentralized technologies, ensuring that the transparency of blockchain does not compromise individual rights.