TL;DR:
- Bithumb was fined 210 million South Korean won ($136,000) for sharing user data with foreign platforms without consent.
- South Korea’s Personal Information Protection Commission determined that the data was transferred to BingX, even though the consent obtained referred to Stellar Exchange.
- The authority also published a data protection guide specifically for blockchain companies, prohibiting the recording of identifiable information on-chain.
South Korea’s Personal Information Protection Commission (PIPC) ordered Bithumb to pay a fine of 210 million South Korean won, equivalent to approximately $136,000, for sharing personal data of its users with foreign platforms without the corresponding consent.
According to the PIPC’s resolution, the violation occurred between September and November of 2025, when Bithumb shared its Tether USDT market order books with overseas platforms. Although the exchange had obtained user consent to transfer information to Stellar Exchange, the data was effectively shared with a platform operated by BingX, constituting a direct deviation from the authorized recipient.
Bithumb Did Not Have Full Consent from Its Users
The Commission also identified a second violation: Bithumb had not obtained full consent from its users when facilitating transfers with 13 international exchanges, in operations that involved names, wallet addresses, and dates of birth.
A Data Protection Guide Is Published
As a result of both violations, the PIPC ordered the exchange to correct its protocols for transmitting information abroad, in addition to paying the established penalty. In its statement, the commission emphasized that “the cross-border transfer of personal information is a matter closely tied to the right to self-determination of data subjects and, therefore, demands strict compliance with the requirements and procedures stipulated in the Personal Information Protection Act.”
In parallel, the PIPC published a data protection guide designed specifically for companies in the blockchain sector, taking into account the transparent, distributed, and immutable nature of the technology. The guide establishes that information capable of identifying a person, such as names or social security numbers, must not be recorded on the blockchain.
