Share this blog:
A single keystroke credited 695 accounts with 620,000 phantom BTC. They sold it. Bitcoin crashed 16% on one exchange while the rest of the market flatlined. Here's what happened, how contagion works in crypto, and why it didn't spread.
What Happened
A Bithumb employee typed "BTC" instead of "KRW" while processing a routine promotional giveaway. The "Random Box" event was supposed to distribute modest cash prizes of ₩2,000-50,000 (roughly $1.37 to $34) to participants. Instead, the system credited 620,000 Bitcoin, worth roughly $44 billion, to 695 user accounts. Each recipient received at least 2,000 BTC, approximately $142 million per person at the prevailing price of ~$71,000/BTC. That phantom sum equaled nearly 3% of Bitcoin's total supply and exceeded Bithumb's actual Bitcoin holdings by a factor of 15.
The credited Bitcoin existed only on Bithumb's internal ledger, not on-chain. No actual Bitcoin was transferred on the blockchain. But that distinction made no difference to the order book. Users who suddenly saw enormous BTC balances began selling immediately into real buy orders. In the roughly 35-minute window between the erroneous distribution and account freezes, 86 users managed to sell approximately 1,788 BTC worth of phantom Bitcoin on the open market. Bithumb CEO Lee Jae-won later admitted in parliamentary testimony that the exchange reconciles its internal ledger with actual crypto holdings only once every 24 hours, a gap that allowed phantom balances to be traded as if they were real.
Bitcoin on Bithumb crashed 16% in minutes. At 10:36 UTC on February 6, 2026, BTC/KRW hit a low of ₩81.1 million (~$54,990), creating an unprecedented "inverse Kimchi premium" where Bithumb was trading at a steep discount to every other exchange. Global prices on Binance, Coinbase, Bybit, OKX, Kraken, and even Upbit (Korea's largest exchange, trading the same BTC/KRW pair) all remained stable around $65,500. Bithumb froze affected accounts and recovered 99.7% of the erroneous credits within hours, covering the full 1,788 BTC shortfall from corporate reserves.
For broader context on the market environment, see our Amberdata Crypto Market Review 2025 and 2026 Outlook: Six Regimes, One Story and our 2026 Outlook: The End of the Four-Year Cycle.
The Crash in Data: 3.8x Volume, Net Buyers Won
Bithumb traded 13,404 BTC on February 6, roughly 3.8x its normal daily baseline. This was not a single rogue trade or a thin-book wick. It was sustained selling from multiple phantom-balance accounts hitting live bids, met by an equally aggressive buy-side response.
The minutely price overlay across all seven exchanges makes the isolation immediately visible. Bithumb drops off a cliff while every other line flatlines. Even Upbit, same country, same currency pair (BTC/KRW), same regulatory framework, barely moved (rebased low of 99.2 versus Bithumb's 94.3). The crash was not even Korea-specific. It was contained to a single venue within Korea.
Despite the aggressive phantom selling, net volume in the crash window was positive: +462.9 BTC. In the +/-1 hour crash window, buy volume totaled 3,180.4 BTC versus sell volume of 2,717.6 BTC. On a full-day basis, net taker flow was +668 BTC. The phantom wallets were aggressive sellers, but the dislocation attracted equally aggressive buyers. When BTC is trading at $55,000 on one venue and $65,500 everywhere else, the incentive to buy the cheap side is enormous: roughly $10,500 per BTC in theoretical spread at the trough.
The volume chart shows a massive sell spike at the crash moment, immediately met by comparable buy-side aggression. Net volume stays positive throughout. The recovery was fast because domestic Korean buyers already on the platform stepped in. This was not global arbitrage capital flowing in. It was opportunistic buying by participants who happened to have Bithumb accounts and KRW balances.
Why Traditional Arbitrage Failed, and Where It Partially Worked
Cross-exchange arbitrage was physically impossible. The classic crypto arb (buy cheap on one venue, withdraw, sell at full price on another) could not work here because the phantom BTC existed only in Bithumb's internal database. No actual Bitcoin was credited on-chain, so nothing could be withdrawn to Binance, Coinbase, or any other exchange. South Korea's strict capital controls further constrained any international vectors.
But there was one partial route: buy on Bithumb, sell on Upbit. Both are Korean exchanges. Both trade BTC/KRW. Both require Korean bank accounts. A domestic trader holding accounts on both platforms could buy at Bithumb's ~$55,000 price, wait for the withdrawal freeze to lift, transfer the BTC, and sell at Upbit's ~$65,500. This makes Upbit the most logical venue for any arb-related sell pressure to appear, for three reasons:
- Same currency: both trade BTC/KRW, so there is no FX conversion or stablecoin hop required
- Same jurisdiction: Korean residents can hold verified accounts on both, unlike global exchanges which are inaccessible to most Korean retail
- Fastest settlement path: on-chain BTC transfer between two Korean exchanges is the shortest possible route to close the arb
The data supports this. Upbit had the highest sell aggressor spike among all non-Bithumb exchanges, hitting a max of 0.701 (where 0.50 is neutral). Upbit also showed the highest momentary correlation with Bithumb's selling pattern: a max rolling 5-minute correlation of +0.974, versus an average of -0.234 over the full window. That signature, a brief, sharp spike in correlated selling followed by a return to normal, is exactly what you would expect if a small number of domestic arbers executed the Bithumb-to-Upbit leg during the event. Importantly, Upbit's price barely moved (rebased low of 99.2), meaning the sell pressure was easily absorbed by Upbit's deeper liquidity.
The arb carried significant risk. Bithumb could (and did) reverse trades from phantom wallets. Bithumb froze withdrawals, so even confirmed purchases could not be moved off-platform immediately. And the price gap could close before the second leg executed. The buying was therefore a mix of directional bets, limited domestic arb, and opportunistic dip-buying, not traditional risk-free arbitrage. For more on how cross-exchange execution mechanics work in crypto, see our Beyond the Spread: Market Impact and Execution analysis.
Did It Spread? Three Contagion Tests
The real question for the broader market is whether the crash transmitted beyond Bithumb, especially to derivatives markets where leverage amplifies everything. Contagion between crypto exchanges travels through three channels:
- Price transmission: a crash on one venue drags prices down on others via arbitrage or index feeds
- Leverage transmission: a spot price move feeds into derivatives mark prices, triggering liquidations that force further selling, creating the classic cascade we documented in our analysis of how $3.21B vanished in 60 seconds during October 2025
- Sentiment transmission: a dramatic crash spooks traders on other venues, causing preemptive selling or funding rate shifts
The Bithumb data lets us test all three independently.
Test 1: Price transmission. Verdict: none.
At the trough, Bithumb traded at discounts of -5.68% vs Upbit, -5.28% vs Bybit, -5.24% vs OKX, -5.21% vs Binance, -5.16% vs Kraken, and -5.13% vs Coinbase. The critical observation: the spreads between the other six exchanges remained near zero throughout. Upbit did not diverge from Binance. Coinbase did not diverge from OKX. One line dropped while six others flatlined.
Test 2: Leverage transmission. Verdict: negligible.
This is the test that separates a contained event from a cascade. When a spot price move feeds into derivatives mark prices, it triggers liquidations on leveraged perpetual positions, forcing further selling, which triggers more liquidations. That feedback loop powered October 2025's $19 billion deleveraging. During the Bithumb crash, total liquidations in the 15-minute window around the event (10:23 to 10:38 UTC) across Binance, Bybit, and OKX BTC perpetuals were just $39,989. Of that, $8,225 were long liquidations (sells) and $31,764 were short liquidations (buys). The full-day liquidation ratio was 1.34x baseline, where ~1.0x means no cascade and >>2.0x would signal contagion. Barely above normal.
The structural reason: Bithumb is not in any major derivatives exchange's mark price index. Binance, Bybit, and OKX calculate their BTC perpetual mark prices using their own spot books and selected global venues, primarily USD and USDT pairs from liquid, globally accessible exchanges. Bithumb's KRW-denominated price feed does not qualify. The $54,990 print never touched any liquidation engine. No mark price moved. No cascade began.
Test 3: Sentiment transmission. Verdict: zero.
Even without direct price or liquidation linkage, a dramatic crash can spook sentiment. If traders on Binance or Bybit saw the Bithumb headlines and panic-sold or shorted, funding rates would shift. The data: pre-event average funding was +2.46% APR; event-day average was -1.84% APR. This is within normal range and reflects broader market conditions (the same macro deleveraging we track in our weekly snapshot), not a Bithumb-specific reaction. The derivatives market effectively did not notice the event occurred.
Three independent channels tested, all negative. The verdict: contained.
Which Exchanges Matter, and Why Bithumb Doesn't
Bithumb accounted for 1.4% of BTC spot volume across the seven exchanges in this analysis ($2.63 billion out of $188.1 billion total). A venue handling roughly one cent of every dollar in BTC trading across these exchanges does not have the gravitational pull to drag the broader market.
The sell aggressor ratio confirms selling pressure did not transmit. During the crash window, Bithumb's sell ratio spiked to a max of 0.619 (where 0.50 is neutral). No other exchange's sell ratio followed in any sustained way. The 5-minute rolling correlation between Bithumb's sell aggressor ratio and each other exchange averaged well below 0.80 across the board (the contagion threshold), ranging from -0.234 (Upbit) to +0.364 (Binance). Traders on global exchanges did not start selling in sympathy.
What makes an exchange systemically important in crypto comes down to three things:
- Volume share: does the exchange move enough capital to affect composite prices?
- Index inclusion: does the exchange's price feed into derivatives mark price calculations that trigger liquidation engines?
- Currency accessibility: can global participants trade on the exchange, enabling cross-venue arbitrage that transmits prices?
Bithumb fails all three. Contrast with Binance (27.7% share), Coinbase (26.3%, feeds multiple indices), Bybit (16.3%, globally accessible USDT liquidity), and OKX (18.3%). An identical error at any of these venues would interact with all three transmission channels simultaneously. The volume hierarchy makes it clear: there is a small group of exchanges where errors are systemically relevant, and a long tail where they are not.
Four Structural Firewalls
The containment verdict is clear. But the Bithumb incident is most useful as a framework for what would turn a single-venue event into something systemic. Four structural factors kept this contained:
1. Not in derivatives indices. Bithumb's price does not feed into any major perpetual contract's mark price calculation. If it did, the $54,990 print would have dragged mark prices lower across Binance, Bybit, and OKX simultaneously, triggering liquidation engines. This is the single biggest firewall, and it is not a deliberate safety mechanism. Bithumb simply does not meet the liquidity and accessibility criteria for index inclusion. The firewall is accidental.
2. KRW-gated. Bithumb's primary BTC pair is denominated in Korean won. Global arb desks cannot access it without Korean banking relationships. If Bithumb listed a BTC/USDT pair with meaningful liquidity, the error would have been visible to, and tradeable by, every participant in the global crypto market. Faster correction, but also a wider blast radius.
3. No on-chain movement. The phantom BTC existed only in Bithumb's internal database. No actual Bitcoin was credited on-chain, so nothing could be withdrawn and sold on other exchanges. The 24-hour ledger reconciliation gap allowed the phantom balances to be traded internally, but it did not allow them to leak into the broader market. If the error had produced real, withdrawable BTC and holders had moved it to Binance or Coinbase before the freeze, the sell pressure would have appeared on global venues directly.
4. Response speed. Bithumb froze affected accounts within roughly 35 minutes. The most violent price dislocation concentrated in a much narrower window. A slower response of an hour or longer would have meant larger phantom selling volumes, a deeper dislocation, and a wider window for sentiment contagion via social media and news alerts.
Contagion Risk Checklist: How to Assess the Next Event
The Bithumb data provides a practical framework for assessing any future single-venue event. When the next exchange error, hack, or operational failure occurs, run through this checklist:
- Is the exchange in any derivatives mark price index? If yes, the spot error will feed directly into liquidation engines. This is the highest-risk factor.
- Is the affected pair globally accessible (USD/USDT) or currency-gated (KRW/JPY)? Globally accessible = wider blast radius, faster transmission. Currency-gated = contained but slower correction.
- Did the error produce real, withdrawable assets or database-only entries? If real and withdrawable, expect sell pressure to appear on other venues. If database-only, containment is structural.
- How fast did the exchange respond? Every minute of delay expands the window for volume, dislocation, and sentiment transmission.
- What is the exchange's volume share? Below ~2%, unlikely to move composite prices. Above ~10%, systemic relevance increases sharply.
Bithumb cleared every firewall: not in indices, KRW-gated, database-only phantoms, relatively fast freeze, 1.4% volume share. The answers to these five questions predict the outcome more reliably than the size of the initial price move.
The Fallout
The regulatory response has been swift. South Korea's Financial Supervisory Service (FSS) began an on-site inspection at Bithumb headquarters on February 7 and escalated to a full-scale formal investigation on February 10. On February 11, regulators launched emergency inspections of four additional major exchanges: Upbit, Coinone, Korbit, and GOPAX. CEO Lee was summoned before the National Assembly for parliamentary testimony, where he admitted to the 24-hour reconciliation gap. FSS Governor Lee Chan-jin characterized the incident as exposing "fundamental weaknesses in the virtual asset information system" and advocated for bank-grade regulation of crypto exchanges.
Bithumb's direct financial loss is manageable, but the strategic damage is significant. The exchange covered the 1,788 BTC shortfall from corporate reserves, established a permanent ₩100 billion (~$68 million) Customer Protection Fund, and announced compensation for panic-sell victims (100% of the price difference plus a 10% consolation bonus). But Bithumb had been pursuing plans to become the first South Korean crypto exchange to list on a U.S. stock exchange in 2026, an ambition now severely complicated. The incident widens the competitive gap with Upbit, which commands 68% of Korean market share. The closest Korean precedent, Samsung Securities' 2018 "ghost stock" error, resulted in criminal indictments and regulatory fines.
For traders who profited, the legal position is clear. Bithumb is individually contacting all recipients who sold or withdrew phantom BTC, demanding full return and explicitly threatening civil lawsuits for unjust enrichment. FSS Governor Lee warned that users who have not returned funds are in a "catastrophically precarious position." Notably, there are no reports of clawback attempts against traders who simply bought BTC at the dip price on Bithumb's order book. These appear to be treated as legitimate market transactions.
The Firewalls Held. They're Not Designed Protections.
The Bithumb flash crash is one of the cleanest natural experiments in crypto market structure. A single venue experienced a dramatic, well-defined shock with a known cause, and data across seven spot exchanges and three derivatives exchanges shows containment on every dimension. Price did not transmit. Liquidations totaled under $40,000 in the crash window. Funding rates did not flinch. Selling behavior did not correlate across venues.
But the firewalls that held are structural artifacts, not engineered protections. Nobody designed the mark price index system to insulate the market from Bithumb errors. It is a byproduct of Bithumb being too small and too illiquid to qualify. The currency gate exists because Korean regulatory requirements create a semi-closed market, not because anyone decided KRW isolation was a desirable safety feature. These structural artifacts can erode without anyone noticing. If Korean exchanges expand USDT liquidity, the currency gate weakens. If a growing exchange gets added to an index, the firewall changes.
The Bybit hack in February 2025 was a security event ($1.46 billion). Bithumb was an operational error ($44 billion in phantom assets). Both types will continue to occur. The question is always transmission. The three-channel framework (price, leverage, sentiment) provides a real-time assessment tool. This time, all three said contained. For context on how contagion does transmit when the firewalls fail, see our analysis of The Perfect Storm: Why Bitcoin Crashed Below $100K & [Bitcoin Below $70K: The Crash, The Data, and What Comes Next].
A 16% crash sounds dramatic. The data says it was irrelevant to the broader market, because of where it happened, not because of how the market responded. Move the same error to a different venue, and the data would tell a very different story. The Bithumb incident, and the broader fragility it exposes, is one of the themes we explore in depth in our 2026 Outlook: The End of the Four-Year Cycle.
Full-Market Research. Institutional Depth. Derivatives, ETFs, on-chain, DEXs, microstructure, risk signals, and more. Subscribe at the bottom of our page for research that covers every corner of crypto and visit Amberdata Research.
Access Amberdata Intelligence for institutional-grade digital asset intelligence, or contact our team to discuss custom solutions.
Links & Resources
Platform
Recommended Next Reads
2025 Review
2026 Outlook
ETF Cost Basis Series
- Part 1/3: The $80,000 Floor (ETF Cost Basis)
- Part 2/3: Who Breaks First (ETF Cost Basis)
- Part 3/3: The Stress Test (ETF Cost Basis)
More Key Reads
• Bitcoin Volatility Surges as Macro Data and Derivatives Signals Align
• Bitcoin’s Great Rotation: Who Bought the Dip and Why It Matters
• October 2025 Crash Explained Through 7 Charts
• Five Signals of FOMC Impact on Crypto Market Microstructure
Disclaimers
The information contained in this report is provided by Amberdata solely for educational and informational purposes. The contents of this report should not be construed as financial, investment, legal, tax, or any other form of professional advice. Amberdata does not provide personalized recommendations; any opinions or suggestions expressed in this report are for general informational purposes only.
Although Amberdata has made every effort to ensure the accuracy and completeness of the information provided, it cannot be held responsible for any errors, omissions, inaccuracies, or outdated information. Market conditions, regulations, and laws are subject to change, and readers should perform their own research and consult with a qualified professional before making any financial decisions or taking any actions based on the information provided in this report.
Past performance is not indicative of future results, and any investments discussed or mentioned in this report may not be suitable for all individuals or circumstances. Investing involves risks, and the value of investments can go up or down. Amberdata disclaims any liability for any loss or damage that may arise from the use of, or reliance on, the information contained in this report.
By accessing and using the information provided in this report, you agree to indemnify and hold harmless Amberdata, its affiliates, and their respective officers, directors, employees, and agents from and against any and all claims, losses, liabilities, damages, or expenses (including reasonable attorney's fees) arising from your use of or reliance on the information contained herein.
© 2026 Amberdata. All rights reserved.