Bithumb recognizes critical weaknesses that left systems open to internal sabotage

Bithumb claims that “serious flaws” in its internal controls left the exchange vulnerable to internal sabotage and allowed a major operational error: bitcoins worth more than $40 billion were sent to customers. The incident shows how a simple oversight lapse can turn into a systemic event at a high-volume location. The platform was supposed to process a payment of 620,000 won, or about $428, but instead transferred 620,000 bitcoins, turning a routine workflow into a market shocker almost instantly.

Controls, regulators and remaining gap

Bitcoin on Bithumb fell 17% when the transfers took place, turning a control failure into a market signal. Regulators are treating this episode as a market problem, not just an operational incident. The Financial Monitoring Service said it would investigate “high-risk” practices: whale manipulation, schemes related to the suspension of deposits and withdrawals, and coordinated pumps linked to misinformation on social media. It also includes tools to extract suspicious patterns at the seconds and minutes level, as well as AI text analysis.

At a recent parliamentary hearing, CEO Lee Jae-won said the giveaway was worth about 15 times the exchange’s 42,000 bitcoins. Lee’s testimony presents processing latency as the multiplier that turned an error into a major event. He blamed a 24-hour delay in processing transactions and delayed updates to the platform’s crypto holding balance, saying the organization was “acutely aware” of gaps in the system’s internal controls. In other words, books have not kept pace with real-time currency movements.

Lee also admitted that Bithumb’s policy to ensure transfers matched actual holdings had failed and that the amount was not reserved in a separate account to protect the transfer. When asset matching and account segregation fail together, preventive controls turn into cleanup work. Bithumb said the weaknesses left its internal system wide open to potential sabotage, raising questions about how transfers were initiated, verified and reconciled. The hearing pressed on why a $428 payment could trigger that scale today.

Most of the coins have been recovered, but 1,786 bitcoins sold before the accounts were frozen remain missing. This remaining gap keeps the incident legally and regulatory active. Customers who sold them are legally required to return the bitcoins, while weak oversight has been criticized. A cited report states that South Korea has 10 million crypto investors and exchanges such as Upbit and Bithumb generate revenue worth billions of won. The focus is now on remediation times.