Coinone Data Breach Exposes Passwords and Sensitive Customer Records

Coinone Data Breach Exposes 11 Categories of Sensitive Information

According to Coinone’s official disclosure, the intrusion occurred around 4 a.m. Korean Standard Time on Thursday, Nov. 12, when an unauthorized attacker accessed servers operated by MetaM, which handles the exchange’s telephone and online customer consultations. The contractor notified Coinone at approximately 9:20 a.m. that morning, while the exchange publicly disclosed the incident on Nov. 15.

Coinone ranks as South Korea’s third-largest cryptocurrency exchange by trading activity, trailing Bithumb in second place and market leader Upbit. The South Korean trading platform counts OKX among its financial backers, with the exchange holding a 20% stake and the remaining ownership divided among Coinone founder and CEO Cha Myung-hoon, Com2uS Holdings, and Korea Investment & Securities.

In its announcement on Sunday, Coinone acknowledged the seriousness of the security failure, stating:

“Although we have made protecting your personal information our top priority, we must inform you that an external attacker gained unauthorized access to the servers of a contractor we hired to handle customer support, and your personal information was leaked.”

The exchange added:

“As the company that outsourced this work, we feel a deep sense of responsibility for this incident and sincerely apologize.”

The potentially compromised know your customer (KYC) information encompasses 11 categories: telephone numbers, names, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers, identification document issuance dates, residential addresses, cryptocurrency wallet addresses, and transaction identifiers (TXIDs).

Not every customer necessarily had all 11 categories exposed. The compromised records concern information voluntarily supplied during previous customer support interactions, meaning customers who never contacted Coinone’s support center fall outside the incident’s identified scope.

Coinone has not disclosed how many individuals were affected or precisely how much information attackers obtained. The company intends to introduce a dedicated lookup service allowing customers to determine which personal details were involved.

Coinone Insists Customer Funds Are Safe Despite Security Breach

Despite the sensitive nature of the exposed records, Coinone maintains that its principal trading infrastructure remained untouched. Its customer accounts, transaction systems and cryptocurrency wallets operate independently of MetaM’s compromised servers.

The exchange emphasized:

“The partial information leaked so far is not sufficient for a third party to log in to your account or withdraw your assets.”

Coinone explained that its authentication procedures require additional verification through registered one-time passwords or Kakaotalk, while unauthorized login methods are blocked. Nevertheless, the absence of a direct wallet compromise does not eliminate the possibility of subsequent financial fraud.

Following the discovery, Coinone said it blocked suspicious IP addresses, restricted access to compromised systems, strengthened transaction monitoring and temporarily transferred outsourced customer support operations to email-only service.

The exchange also notified the Korea Internet & Security Agency, Personal Information Protection Commission, and Financial Supervisory Service. Investigators, Coinone explained, are examining the intrusion alongside MetaM and outside security specialists.

Particularly concerning is the potential misuse of customer support conversations. Attackers possessing identification numbers, banking information, and historical correspondence could construct convincing impersonation and phishing schemes targeting unsuspecting customers.

Coinone cautioned:

“Calls or messages that reference your past support conversations may also be impersonation attempts, so please be cautious.”

Customers who previously disclosed passwords during support interactions were instructed to change those credentials immediately, including on unrelated services where identical passwords were reused.

Five Major Crypto Data Breaches Cast Shadow Over 2026

Coinone’s disclosure follows several other notable customer information breaches involving cryptocurrency businesses during 2026, illustrating how attackers increasingly exploit operational systems beyond traditional exchange wallets.

On Nov. 3, Gnosis Pay experienced unauthorized access involving its legacy cryptocurrency debit card infrastructure, potentially exposing customer information, including payment card details and wallet addresses.

Chainalysis disclosed a separate security incident in late October, subsequently expanding its findings in early November. The analytics company’s investigation identified exposed account credentials, password hashes and authentication tokens, although it reported no evidence that sensitive investigation records were accessed.

South Korean exchange Bithumb also encountered unauthorized access to internal communications infrastructure in October. Its investigation identified records associated with 6,444 customers, including directly exposed personal information belonging to 844 individuals.

Meanwhile, Coinbase disclosed customer information exposure associated with a September security incident involving third-party analytics provider Amplitude. The exchange maintained that its own infrastructure and customer funds were unaffected.

These incidents differ considerably in scope and technical circumstances, but collectively demonstrate that customer information can remain vulnerable even when cryptocurrency custody systems escape compromise. Under South Korean privacy legislation, affected Coinone customers may pursue statutory damages of up to 3 million won when proving actual financial losses is difficult.

For Coinone, the unresolved questions concern the number of affected customers, the information actually extracted, and whether additional fraud emerges. The broader concern extends beyond cryptocurrency theft: Even exchanges that successfully protect customer assets can expose users to lasting financial and identity risks through inadequately secured third-party relationships.