South Korea fines Bithumb 210M won for data exports

South Korea's Personal Information Protection Commission ordered crypto exchange Bithumb to pay a 210 million won fine after finding the company exported customers' personal information to overseas platforms without obtaining full consent.

The regulator found the exposure occurred when Bithumb shared Tether (USDT) market order books between September and November 2025. The PIPC determined that user names, wallet addresses and dates of birth were included in the shared data.

Bithumb had obtained consent to transfer data to the Stellar exchange, but the commission concluded the information was sent instead to a platform operated by BingX. The regulator also found Bithumb did not secure full consent while facilitating transfers with 13 overseas exchanges.

The PIPC ordered Bithumb to pay the 210 million won penalty and to revise its procedures for cross-border transfers of personal data to comply with the Personal Information Protection Act.

The commission published an information protection guideline for blockchain firms that takes into account the technology's transparent, distributed and immutable characteristics. The guideline advises that information capable of identifying an individual, such as names and social security numbers, should not be recorded on a public blockchain.

The commission noted that cross-border transfers relate directly to an individual's right to control their personal data and must follow the act's requirements.

Bithumb must follow the corrective order and ensure future overseas transfers meet legal consent requirements. The regulator's action increases scrutiny on how exchanges manage cross-border data flows and the handling of personally identifiable information in blockchain-linked services.