Bithumb gets $136K wrist-slap for shipping user data abroad without asking first 🙃

South Korean cryptocurrency exchange Bithumb has been ordered to pay a $136,000 fine after regulators found the platform transferred personal information overseas without obtaining the separate consent of the data subjects. In a Thursday notice, the country's Personal Information Protection Commission (PIPC) said its investigation into Bithumb determined that the exchange "transferred personal information overseas without the separate consent of the data subjects during the process of order book sharing and virtual asset transfer with overseas virtual asset exchanges."

The incident centers on Bithumb sharing its Tether (USDT) order books between September and November 2025 with BingX, despite having secured user consent only to share the data with Stellar. The PIPC also found that the exchange shared user information with 13 overseas exchanges. "The Personal Information Protection Commission determined that there is a necessity to provide personal information for anti-money laundering purposes when transferring virtual assets to other exchanges, but regarding the overseas transfer of personal information and the data subject's right to self-determination, it was determined that, as this is a closely related matter, it is necessary to strictly comply with the requirements and procedures stipulated in the Protection Act," the notice said, in translation.

One of the largest crypto exchanges in South Korea, Bithumb has faced heightened regulatory and law enforcement scrutiny in recent months. The country's financial watchdog imposed a six-month suspension of the exchange's activities in March over alleged violations of South Korea's Financial Information Act, though a court reversed that decision in April. Earlier this month, police reportedly raided Bithumb's offices as part of an investigation into alleged nepotism involving South Korean lawmaker Kim Byung-gi.

South Korea's Finance Ministry confirmed in May that a 22% tax on cryptocurrency gains would be imposed beginning in January 2027. The levy has faced multiple delays after originally being expected to take effect in 2025. According to the Yonhap news agency, about 16 million South Koreans were invested in digital assets as of March 2025. Earlier this month, Chainalysis said it signed a memorandum of understanding with the Korean National Police Agency (KNPA) aimed at building investigative capability within South Korea's law enforcement, including efforts to combat North Korea-linked crypto attacks.