Bithumb Fined in South Korea for Illegally Transferring User Data Abroad

South Korea is tightening its grip on data protection within the crypto sector. Bithumb, one of the country’s largest exchanges, has just been hit with a financial penalty for transmitting users’ personal information to foreign entities without their consent.

The decision comes amid a broader wave of global regulatory tightening around cryptocurrency trading platforms — and could set a significant precedent across the region.

Behind the fine lies a fundamental question: how far can exchanges go in exploiting their users’ data?

A $136,000 Fine for Data Protection Violations

South Korean authorities ordered Bithumb to pay a penalty of approximately $136,000 after determining that the platform had shared users’ personal data with third parties located abroad, without obtaining prior consent. The ruling was issued by regulators responsible for enforcing the Personal Information Protection Act (PIPA), South Korea’s primary legal framework governing private data.

PIPA imposes strict obligations on companies that process personal data: any cross-border transfer must be clearly disclosed and explicitly consented to by the users concerned. By bypassing this requirement, Bithumb exposed its customers to the potential risk of uncontrolled disclosure of their information — including names, contact details, and transaction histories — to entities whose jurisdiction and security practices may differ significantly.

While the fine may appear modest relative to Bithumb’s trading volumes, the symbolic weight of the sanction is far greater. It sends a clear signal to industry players: compliance with personal data regulations is not optional, even for established exchanges.

Bithumb Under Regulatory Scrutiny: A History of Controversy

This is not the first time Bithumb has found itself under regulatory pressure. The platform, founded in 2014, has weathered several crises over the years: major hacks in 2018 and 2019 that resulted in losses of tens of millions of dollars, tax investigations, and allegations of market manipulation. These episodes have repeatedly damaged the exchange’s reputation despite its dominant position in the Korean market.

South Korea ranks among the most active crypto markets in the world, with trading volumes that consistently place it at the top globally. This intensity of activity naturally attracts heightened regulatory scrutiny. Since the Virtual Asset Service Provider (VASP) Act came into force in 2021, Korean authorities have significantly strengthened their oversight of exchanges — requiring official registrations, security audits, and strict compliance with anti-money laundering rules.

The sanction imposed on Bithumb fits squarely within this dynamic of reinforced supervision. It illustrates that Korean regulators no longer hesitate to target major platforms, including on issues that go beyond the strictly financial to touch on users’ fundamental rights.

A Warning for the Entire Crypto Exchange Sector

Beyond the Bithumb case, this affair raises a structural issue for the entire centralized exchange (CEX) industry. These platforms collect massive volumes of KYC (Know Your Customer) data — passports, proof of address, biometric data — as part of their regulatory anti-money laundering obligations. The management, storage, and transfer of this data has therefore become a major compliance challenge.

At a time when the European GDPR continues to set the standard internationally, and similar frameworks are emerging across Asia, exchanges operating across multiple jurisdictions must urgently adapt their practices. Sharing user data with foreign partners — technical service providers, subsidiaries, third-party regulators — without a solid contractual framework and without explicit consent now carries the very real risk of concrete penalties.

For users of centralized platforms, this type of case serves as a reminder of the importance of reviewing the privacy policies of the exchanges they use, and of understanding precisely what data is collected and for what purposes it may be shared. Platform transparency on this issue is fast becoming a selection criterion in its own right.