- Hackers breached South Korea’s Financial Security Institute by impersonating a regulator and exploiting a login backdoor.
- About 300 personal records, mainly belonging to financial firm employees, were exposed.
- Regulators have launched an on-site inspection, and police are examining IP data from the attack.
South Korea’s Financial Security Institute (FSI), the agency investigating a wave of bank hacks, has itself been hacked.
Attackers got hold of about 300 personal records of people who work in the financial sector.
How did hackers break into South Korea’s financial security agency?
South Korea’s Financial Security Institute (FSI) got hacked after the attackers exploited a weak spot in the institute’s login system.
The hacker pretended to be an official from the Financial Supervisory Service (FSS) and gained access to the FSI’s system through a backup access page meant for times when text-message verification is not available. That page skipped the usual checks.
The fake FSS account used by the attackers can see files from many institutions at once, unlike a normal company that can only open its own. The attackers reportedly kept changing their IP addresses to look like normal traffic and ended up using more than 100 different addresses.
The FSI found the breach on Monday, November 9, and after shutting down the affected system, it reported the incident to the Financial Services Commission and the Korea Internet & Security Agency.
The hacked platform was the FSI’s Continuous Evaluation Support System, where financial firms upload documents for security reviews. About 3,000 companies go through this review each year.
About 200 administrative forms were leaked as well as more than 300 personal records with names and birth dates, and about 350 user records with partly hidden names and phone numbers.
Most of the personal data belonged to employees who handle security reviews at financial firms. So far, more than 40 companies have been linked to the breach.
So far, no reports show that customer credit information or transaction records were leaked during the breach. The FSI has said its network diagrams and vulnerability test results were not affected. It also promised to pay compensation if the leaked information results in further harm.
On Tuesday, November 10, police were given the attacker’s IP data. The next day, financial regulators started an on-site check of the FSI’s security. Investigators are still trying to figure out how the fake FSS account gained legitimate regulator-level access.
What does the FSI getting hacked mean for banks and crypto exchanges?
The timing of the hack is awkward for the FSI, which has been leading cyber defense for Korea’s financial industry. Since 2025, it has also run a team focused on digital-asset security, led by an ethical hacker, to raise security standards at crypto exchanges.
Korean exchanges have been hacked repeatedly this year. For instance, Bithumb reported on October 27 that an unauthorized party had reached its internal mobile groupware system and exposed employee information. Daishin Securities (KRX: 003540) said data on 38,490 customers was compromised.
Regulators counted more than 4.4 million scanning attempts in a single day, mostly from North Korean IP ranges. However, an FSI official warned against drawing conclusions since IP data can be faked or rerouted and cannot prove who is behind an attack on its own.
In October, the Financial Services Commission said suspected AI-driven attacks hit 16 firms, including banks, savings banks and crypto businesses. That number rose to 20 by the end of the month. About 100,000 records were exposed. Inspectors who reviewed 555 companies found security problems at 130 of them.
On November 6, Gopax, which is owned by Binance, stopped all trading and transfers and moved customer tokens into offline cold storage. The exchange hadn’t been robbed or breached, but regulators recommended the change from hot to cold wallets following a series of breaches, Cryptopolitan reported.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
How did hackers get into the Financial Security Institute?
They impersonated an official from the Financial Supervisory Service and exploited a temporary access page meant for cases where SMS verification was unavailable, logging in through an account with regulator-level permissions.
What data was exposed in the FSI breach?
About 200 administrative forms, more than 300 personal records with names and birth dates, and roughly 350 user records with partially masked names and phone numbers, mostly belonging to assessment staff at financial firms. No customer credit information or transaction records were taken.
How does this connect to the crypto exchange hacks?
The FSI runs a digital-asset security unit meant to strengthen crypto exchanges, which have been hit in the same wave: Bithumb disclosed an employee-data breach on October 27, and Gopax halted trading on November 6 to move tokens into cold storage, per the Korea Times and Cryptopolitan.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
