Woori Bank NFT Project Exposes Data of 17,551 Customers

Financial institutions are expanding into NFT platforms as Web3 technology develops, but weak oversight of contractors has created cybersecurity vulnerabilities. South Korea’s Woori Bank launched an NFT project in September 2024 and outsourced its development. An employee of Blocko, a blockchain company hired as a subcontractor, improperly retained customer data and uploaded it to a developer platform. The incident highlights the third-party supply-chain risks financial institutions face in their digital transformation.

Woori Bank discovered the leak on June 30, 2026, immediately blocked external access and notified South Korea’s Personal Information Protection Commission. The exposed data affected about 17,000 customers, or 17,551 people in total, and included customer nicknames and encrypted identification data known as CI. The bank activated its unusual-transaction detection system and said it had found no malicious misuse of the personal data so far, but urged affected users to remain alert for scam text messages.