South Korea has fined crypto exchange Bithumb 210 million won ($136,000) for sharing user data overseas without proper consent. The penalty followed a multi-month investigation by the Personal Information Protection Commission.

The decision marks one of South Korea’s most direct crypto privacy enforcement actions to date.

Why South Korea Fined Crypto Exchange Bithumb

Cross-border data transfer is the movement of personal information from one jurisdiction to another, a process subject to strict consent rules under South Korean law. Bithumb violated those rules during cryptocurrency transactions between September and November 2025, according to the official commission findings.

The investigation focused on customer data linked to Tether’s USDT market activity. Furthermore, the commission concluded that the exchange failed to comply with the legal requirements governing overseas transfers of personal information across multiple international destinations.

“The Personal Information Protection Commission (PIPC; Chairperson Song Kyung-hee) held its 12th plenary session and agreed to impose a fine of 210 million won on Bithumb Korea Co., Ltd. (hereinafter ‘Bithumb’), as well as to issue a corrective order requiring it to comply with legal requirements regarding the cross-border transfer of personal information, following the discovery of violations of the Personal Information Protection Act (hereinafter the ‘Act’),” reads an excerpt from the PIPC statement.

Follow us on X to get the latest news as it happens.

A key finding involved a clear consent mismatch. Bithumb told users that their data would be moved to the Stellar exchange. However, investigators determined that the information actually ended up on a platform operated by BingX, thereby breaching the required destination accuracy under South Korean privacy law.

The case did not stop there. Investigators uncovered a second compliance failure involving transfers with 13 separate overseas crypto exchanges. Bithumb shared customer names, wallet addresses, and birth dates without obtaining the complete consent required under national privacy regulations.

The commission ordered Bithumb to revise its internal procedures for cross-border data transfers. Moreover, the regulator stressed that exchanges must clearly explain where customer information will be processed before any transfer occurs across international platforms or third-party operators.

What the New Privacy Guidance Means for Crypto Firms

The Bithumb decision arrived alongside fresh privacy guidance for blockchain companies. South Korea designed the framework to address the specific tensions between transparent ledger architecture and the personal information protection rules that govern every regulated business in the country.

The core principle is straightforward. Blockchain companies should avoid recording personally identifiable information on public ledgers. As a result, sensitive data such as names and national identification numbers should remain off-chain whenever the technology allows it, for the operator’s convenience.

Cross-border data movement received the most attention. The commission urged firms to introduce stronger safeguards before transferring customer information to international platforms. Furthermore, exchanges must now verify the actual destination of personal data rather than relying on third-party intermediaries.

The wider regulatory direction is clear. South Korea has steadily expanded its oversight of crypto businesses beyond traditional financial compliance. Privacy protection now sits squarely at the center of regulatory expectations for every digital asset service provider operating across the country.

For Bithumb specifically, the penalty serves as both a financial setback and a reputational warning. However, the broader implication reaches every Korean crypto exchange. Incomplete user consent will now attract stricter enforcement actions as the industry continues to evolve throughout the rest of 2026.

Source: BeInCrypto