Bithumb says “serious flaws” in its internal controls left the exchange vulnerable to insider sabotage and enabled an outsized operational mistake: bitcoin worth more than $40 billion was sent to customers. The incident shows how a single control gap can scale into a systemic event on a high-volume venue. The platform meant to process a payout of 620,000 won, about $428, but instead transferred 620,000 bitcoins, turning a routine workflow into a market shock almost instantly.
Controls, regulators, and the remaining gap
Bitcoin on Bithumb fell 17% when the transfers hit, turning a control failure into a market signal. Regulators are treating the episode as a market order issue, not just an ops mishap. The Financial Supervisory Service said it will probe “high-risk” practices: whale manipulation, schemes tied to suspended deposits and withdrawals, and coordinated pumps linked to social media misinformation. It also plans tools to extract suspicious patterns at second and minute level plus AI text analysis.
At a recent parliamentary hearing, CEO Lee Jae-won said the giveaway equaled about 15 times the exchange’s 42,000 bitcoins. Lee’s testimony positions processing latency as the multiplier that turned an error into a headline event. He blamed a 24-hour lag in processing transactions and delayed updates to the platform’s crypto holdings balance, saying the organization is “acutely aware” of deficiencies in internal system control. In terms, the books did not keep pace with real-time money movement.
Lee also conceded that Bithumb’s policy meant to ensure transfers matched actual holdings failed, and the amount was not earmarked in a separate account to protect the move. When asset-matching and account segregation fail together, preventive controls turn into cleanup work. Bithumb said the weaknesses left its internal system wide open to potential sabotage, raising questions about how transfers are initiated, checked, and reconciled. The hearing pressed why a $428 payout could trigger that scale today.
Most coins were recovered, but 1,786 bitcoins sold before accounts were frozen remain missing. That residual gap keeps the incident active on both legal and regulatory tracks. The customers who sold them are legally bound to return the bitcoin, while lawmakers criticized weak oversight. A cited report said South Korea has 10 million crypto investors and that exchanges such as Upbit and Bithumb generate revenues in the trillions of won. Focus now shifts to remediation timelines.
