Bithumb Hit With $136K Fine Over Customer Data Transfer Error

The fine is small relative to Bithumb's revenue. The ruling sets a compliance benchmark for South Korea's crypto industry. The country's data protection law requires platforms to identify each foreign recipient and secure standalone consent for each one. Many exchanges run referral or airdrop campaigns that involve sending user data to several exchange partners at once. The commission's decision signals that a single blanket clause will not survive review.

Bithumb said in a statement that it respects the commission's decision and will review its data-transfer procedures to prevent a recurrence. The company has 30 days to appeal. The commission did not impose any corrective measures beyond the monetary penalty.

For other exchanges in South Korea, the ruling creates a concrete requirement. Every overseas partner needs its own line-item consent. A generic “we may share your data with third parties” clause will not hold up when the promotion's fine print names a specific recipient. The risk of similar fines applies to any platform that runs cross-border marketing campaigns without updating its consent language.