South Korea's Personal Information Protection Commission (PIPC) fined cryptocurrency exchange Bithumb 210 million won ($136,000) for illegally transferring users' personal information to overseas platforms without proper consent. The investigation uncovered multiple violations of privacy laws, including unauthorized cross-border data transfers between September and November 2025 and failures to obtain legally required user consent. The enforcement action follows earlier anti-money laundering penalties against Bithumb and reflects South Korea's aggressive approach to policing both financial compliance and data protection in the crypto industry.
PIPC Uncovers Unauthorized Data Transfers to Overseas Platforms
According to the PIPC, Bithumb transferred users' personal information overseas while sharing order books with a foreign exchange between September and November 2025. South Korean investigators found that while customers had been informed their information would be transferred to the Stellar exchange, the data was actually sent to bingx.com, a system operated by a different overseas exchange. The transferred information reportedly included customer identification numbers and order-related information.
The regulator also found additional violations involving crypto asset transfers. When users transferred virtual assets to foreign exchanges, Bithumb shared personal information, such as sender and recipient names and wallet addresses, with 13 overseas exchanges for anti-money laundering purposes. While acknowledging the AML rationale, the commission stated: "There is a necessity to provide personal information for anti-money laundering purposes when transferring virtual assets to other exchanges, but regarding the overseas transfer of personal information, the data subject's right to self-determination."
Bithumb Faces Ongoing Regulatory Scrutiny After Earlier AML Penalties
The latest sanction adds to Bithumb's regulatory challenges. Earlier this year, South Korea's Financial Intelligence Unit imposed a 36.8 billion won ($24.5 million) penalty and ordered a partial six-month business suspension over widespread anti-money laundering failures. Although a court later suspended the business restriction pending further proceedings, the exchange continues to face regulatory oversight.
Cross-Border Data Transfers Draw Increased Regulatory Focus
Cross-border data transfers have become a growing focus for regulators worldwide as exchanges rely on global liquidity providers, shared order books, cloud infrastructure, and international compliance partners. In many jurisdictions, these transfers require explicit disclosures and user consent, particularly when personal information leaves the country.
Recognizing the unique challenges posed by blockchain technology, the PIPC released new Blockchain Service Personal Information Protection Guidelines alongside its decision. The guidance addresses issues such as blockchain transparency, decentralized data sharing, and the difficulty of deleting personal information stored on immutable ledgers.
FAQ
What did South Korea's PIPC fine Bithumb for?
The Personal Information Protection Commission fined Bithumb 210 million won ($136,000) for illegally transferring users' personal information to overseas platforms without proper consent, including unauthorized cross-border data transfers between September and November 2025.
How did Bithumb violate privacy laws according to the investigation?
Bithumb transferred user data to bingx.com while informing customers the information would go to the Stellar exchange, and shared personal information including customer identification numbers, sender and recipient names, and wallet addresses with 13 overseas exchanges without satisfying legal requirements for overseas data transfers.
What other regulatory penalties has Bithumb faced recently?
Earlier this year, South Korea's Financial Intelligence Unit imposed a 36.8 billion won ($24.5 million) penalty and ordered a partial six-month business suspension over anti-money laundering failures, though a court later suspended the business restriction pending further proceedings.
