Bithumb, the world's fourth largest cryptocurrency exchange by volume, confirmed a security incident during which an unknown hacker was able to make off with an yet undetermined amount of funds.
Clues that something was wrong emerged on Thursday, when South Korean users, who make most of Bithumb's userbase, started complaining on a local social network about losing control over large funds stored in their Bithumb accounts.
A day later after these complaints, the company officially admitted the breach in a blog post on its website, albeit it did not provide any meaningful details.
Attacker hacked Bithumb employee's PC
More facts came to light on Monday, when pressured by local media, the company revealed that the breach occurred after an unknown attacker hacked the personal computer of a Bithumb employee, from where he stole the details of over 31,800 Bithumb users — about 3% of the platform's entire userbase.
According to local media [1, 2, 3, 4], the hack took place at around 22:00, local time, on Thursday, June 29, and the documents the hacker managed to access contained data on customer names, email addresses, and mobile phone numbers.
Soon after, Bithumb users started complaining online that someone was draining their accounts. It is unclear how the hacker gained control to targeted accounts.
Some users reported losses as big as 10 million won ($8,700) worth of cryptocurrency. Local media grossly estimates that the attacker made off with billions of won in cryptocurrency, but Bithumb never confirmed the exact amount of stolen funds.
Bithumb promises to reimburse users
Based on a blog post published on Monday, the exchange doesn't seem to know the exact amount of money the attacker took. Nonetheless, in a gracious move, the company is willing to provide compensations of up to 100,000 won ($897) per affected user until midnight July 5.
"As soon as the amount of damages is confirmed, we will reimburse the entire amount of damages," said Bithumb in an official statement.
According to user complaints, the hacker stole both Bitcoin and Ethereum from user accounts. Besides being the fourth largest cryptocurrency exchange by volume, Bithumb is also the Internet's second largest Ethereum trading platform by volume.
Bithumb told South Korean media it contacted law enforcement last week and informed them of the theft.
Two months ago, an unknown attacker hacked fellow South Korean Bitcoin exchange Yapizon and stole 3816.2028 Bitcoin (over $5.5 million).
This is not the only Ethereum-related hack that took place this past week. Also last Thursday, an unknown attacker has gained control over the web domain of Classic Ether Wallet, a client-side wallet system for the Ethereum Classic (ETC) cryptocurrency. The hacker set up a fake website, and used it to phish user credentials and intercept and redirect ETC transactions.