Korean police probe Bithumb, Daishin hacks linked to AI breach wave

Data breaches at Bithumb, Daishin Securities and Mirae Asset Global Investments have triggered a preliminary investigation by South Korea’s National Police Agency.

The police agency investigators are looking into the extent of stolen data in the latest breach and checking whether it is connected to an earlier wave of AI-assisted attacks that hit 16 financial firms in the country.

Which South Korean companies were hacked?

Daishin Securities, Bithumb and Mirae Asset Global Investments were the latest firms to be hit in a wave of breaches concentrating in South Korea. The same team at the National Office already working on the bank hacks reported earlier has taken over the Investigation of the newest incidents as of Wednesday morning.

Daishin Securities was the hardest hit, per local reports, with the personal and credit data of 38,490 customers exposed.

So far, Bithumb has confirmed that attackers accessed staff data. The exchange is still assessing whether member information was also stolen.

Information from Mirae Asset Global Investments’ internal business systems was exposed. However, the firm’s statement reported no evidence that personal credit data was taken.

The numbers from the three new incidents, when fully confirmed, will add to roughly 100,000 records exposed at 16 financial companies as of October 14.

Are the South Korean hacks connected?

While no link has been confirmed, investigators from the South Korean National Police Agency are comparing methods used in the recent breaches to identify matches and determine whether the attacks are isolated.

Local outlet Seoul Economic Daily quoted a police official as saying: “We are not ruling out the possibility that this was an attack by the same person behind the bank hacking case.”

If the investigators confirm a connection, it means the same attackers who used ARTEX to hit banks are behind these late-October breaches. ARTEX is a China-built open-source agentic penetration-testing tool that runs alongside large language models such as Claude Code.

Cryptopolitan reported that CrowdStrike found the attacker’s own Claude Code session logs, ARTEX configuration files and memory files sitting in exposed server directories.

CrowdStrike fingered a financially motivated, Chinese-speaking operator with moderate confidence, based on assessments of recovered files. Because the attacker used the same tools to draft a résumé, they leaked their own contact and Telegram details, which CrowdStrike said may belong to a 26-year-old in Maoming, Guangdong.

Notably, the security firm conceded that the identifiers are not 100% reliable.

South Korean specialists are skeptical of Chinese involvement simply on the basis that the tool is Chinese-built. A professor at Korea University’s Graduate School of Information Security questioned whether ARTEX was the only tool used in the attacks.

Victim numbers continue to grow

Earlier this week, KB Kookmin Bank said a detailed re-examination lifted its confirmed victim count from 119 to 2,210. Mirae Asset Life Insurance, a separate entity, also detected intrusions and drew an urgent on-site inspection from the Financial Supervisory Service.

The Financial Services Commission has already run a security review of 555 financial companies and found shortcomings at 130, including missing security patches and no real-time monitoring.

Bithumb, for its part, has been running a campaign warning customers that leaked personal data is being reused in follow-on phishing and remote-access scams.