Bithumb's bitcoin payout blunder results in $1.6 mil. compensation

Prices of cryptocurrencies are displayed on an electronic board at the Bithumb Lounge in Seoul, March 4. Yonhap

Korea's major cryptocurrency exchanges have paid out billions of won in compensation for hacking incidents and system failures in recent years, data showed Sunday, with Bithumb reimbursing users about 2.5 billion won ($1.6 million) following the erroneous distribution of 620,000 bitcoins earlier this year.

According to data submitted by the Financial Supervisory Service and major cryptocurrency exchanges to Rep. Lee Hun-seung of the main opposition People Power Party, one of the costliest incidents involved Bithumb, following an accidental bitcoin crediting incident in February.

An employee mistakenly entered bitcoin instead of Korean won when processing rewards for a promotional event, resulting in the erroneous distribution of about 620,000 bitcoins to 249 users.

The error triggered sharp price distortions, prompting Bithumb to compensate affected users.

In a separate case, Upbit paid about 790 million won in compensation following a security breach in November 2025. Upbit said Solana-based assets worth about 44.5 billion won were transferred to unauthorized external wallets within 54 minutes.

According to the data submitted to the lawmaker, the country's five largest cryptocurrency exchanges reported a combined 57 hacking and system-related incidents between 2020 and April this year.

The exchanges included Upbit, Bithumb, Coinone, Korbit and Gopax.

Upbit accounted for the largest number, with 26 recorded incidents, followed by Bithumb with 14, Gopax with eight, Coinone with six and Korbit with three.

The incidents resulted in compensation payments totaling billions of won. Upbit paid approximately 3.21 billion won, followed by Bithumb with about 3.2 billion won and Coinone with roughly 49 million won.

However, exchanges used different criteria to classify incidents and determine the scope of compensation, highlighting the need for more consistent compensation measures and regulatory framework.

For example, Gopax included errors that prevented users from viewing their asset holdings as system incidents, while Bithumb classified an event as a system failure only when all users experienced difficulties accessing core services for at least 10 minutes.