Bithumb Exchange Social Audit & Trust Score

Bithumb has spent 2026 fighting fires. A mistaken transfer briefly sent billions in BTC to users, while regulators pursued AML penalties, privacy violations, and multiple investigations involving former executives. Financials tell a similar story: revenue is down sharply, losses are mounting, and reports suggest outside capital may be needed. Bithumb still commands meaningful market share and has invested in security, but it's difficult to ignore how many questions are surrounding the company at once.

Bithumb is the second-largest crypto exchange in South Korea and currently the main competitor to Upbit in the KRW trading market. Founded in 2014 in Seoul under the name “Xcoin,” it was rebranded as Bithumb in 2015. In 2017, it was among the largest cryptocurrency exchanges globally, reportedly handling around 70% of the KRW market share. One notable operational incident occurred in 2026 when the exchange mistakenly credited users with approximately 620,000 bitcoins during a promotional event instead of 620,000 won (about $426). Most of the incorrectly distributed bitcoins were later recovered by the exchange, although 1,786 BTC had already been sold within minutes before user accounts were frozen. Bithumb also has a history of security incidents. In February 2017, hackers stole over $1 million worth of Bitcoin and Ethereum from user accounts. In June 2018, the exchange confirmed another breach involving approximately 35 billion won (about $31.6 million) in cryptocurrency losses. In March 2019, a further incident resulted in the theft of around $20 million worth of EOS and XRP, with reports often attributing it to insider vulnerabilities or compromised systems. In June 2019, another attack led to the loss of approximately $30 million in digital assets. Similar to Upbit, Bithumb has generally relied on internal reserves and corporate funds to reimburse users rather than operating a clearly defined public insurance fund. While it has experienced security failures, it has typically reimbursed users in full or near-full amounts. However, they still haven’t done any publicly disclosed Proof of Reserves audit, penetration test, or bug bounty program, which is not something you’d want to see from one of the biggest crypto exchanges.

Bithumb is a regulated entity with unregulated habits. While its Nasdaq listing suggests safety, the $44 billion "Ghost Coin" error and the imminent 6 month suspension for AML failures prove the team is fundamentallly incompetent at risk management. It is a legacy giant that has become too big and too sloppy to trust with high-stakes capital. https://www.koreaherald.com/article/10672048 (ghost btc) https://www.mexc.co/en-NG/news/890122 (suspension)

Regulated Dominant Korean exchange with KRW liquidity, has a history of major hacks (2017–2019) but fully compensated users and has been breach-free since. In Feb 2026, a “fat-finger” typo credited ~695 users with 620,000 BTC (~$44B) -quickly reversed-, causing a 17% BTC/KRW flash crash; 99.7% was recovered, and affected users compensated. The incident exposed internal control flaws, triggered FIU regulatory action, and a 6-month partial business suspension. https://www.coindesk.com/business/2026/03/09/bithumb-faces-proposed-6-month-partial-ban-over-south-korea-aml-breaches Trustpilot (1.4/5) old reviews dated 2024 users complain about huge withdrawal delays, extra commission demands, and system glitches. Good for medium sized trades

Bithumb, one of South Korea's OG heavyweights since 2014, just pulled off the mother of all operational faceplants on Feb 6, 2026 accidentally crediting hundreds of users with 620,000 BTC ($40-44B at the time) instead of tiny promo rewards during a "Random Box" event. They froze affected accounts fast (within 35 mins), recovered 99.7%, covered the shortfall from reserves, and rolled out zero fees for a week plus payouts to impacted sellers. No hack, just epic human/config error, but it triggered immediate regulatory heat from FSC/FSS/FIU with on-site inspections, calls for tougher rules, and scrutiny on internal controls/ledger systems. though theyhave a Past hacks (2018, 2024), but nothing fresh beyond this blunder.