South Korea fines CEX over data lapses

TLDR

South Koreas privacy regulator has fined major exchange Bithumb for illegally sharing user data overseas, putting crypto platforms on notice that strict data rules apply to them too.

1. The Personal Information Protection Commission fined Bithumb 210 million won (~$136,000) for transferring user data abroad without proper consent and ordered fixes to its data-handling processes.
2. The case centers on sharing Tether (USDT) order book data and customer details with overseas exchanges in ways that violated Koreas cross-border privacy rules and new blockchain guidelines.
3. For users and other centralized exchanges, this signals rising regulatory scrutiny around data, AML and cross border transfers, with privacy lapses now carrying both financial and reputational risk.

Deep Dive

1. Details Of The Bithumb Penalty

South Koreas Personal Information Protection Commission (PIPC) fined Bithumb 210 million won after finding it had sent user data to overseas platforms without the required separate consent. Regulators say Bithumb shared its Tether (USDT) market order book between September and November 2025 and sent member identifiers and order data to BingX, despite telling users the destination was Stellar. The commission also found that names, wallet addresses and dates of birth were shared with 13 overseas exchanges without full consent, and ordered Bithumb to correct its overseas transfer protocols and privacy policy. These details are laid out in PIPC linked reporting that fined Bithumb 210 million won.

2. Why South Korea Is Focusing On Data

The PIPC framed cross border transfer of personal information as directly tied to a users right to control their data, requiring strict compliance with the Personal Information Protection Act. In its decision, the commission acknowledged that anti money laundering checks may require some data sharing but stressed that this does not override consent rules or notice obligations. Alongside the fine, regulators published blockchain privacy guidance telling firms not to record identifying information on public ledgers and to design systems with privacy in mind, as described in South Koreas broader crypto privacy crackdown.

3. Impact On Users And Other Exchanges

For Korean users, the immediate impact is limited to Bithumb adjusting how it discloses and transmits data, but the case shows that regulators will treat crypto exchanges like other financial institutions on privacy. For exchanges operating in or touching South Korea, order book sharing, routing via foreign platforms and AML data transfers now need explicit consent, clear disclosures and documented controls, or they risk fines and deeper investigations. The action comes on top of separate probes and court cases involving Bithumb and fits a wider pattern of tighter scrutiny of exchanges and cross border flows, outlined in ongoing investigations into Bithumbs compliance.

Conclusion

South Koreas fine against Bithumb ties privacy enforcement directly to crypto market infrastructure, showing that cross border data handling around order books and transfers is a regulatory priority. The penalty itself is modest, but the corrective orders and new blockchain privacy guidance signal that user data, AML and international routing are converging into a single compliance risk area that exchanges and users need to watch closely.