South Korea’s Coinone data breach may expose passwords, IDs, wallet addresses

South Korean cryptocurrency exchange Coinone has disclosed a customer data breach involving its outsourced support provider, with passwords, identification numbers and cryptocurrency wallet addresses among the information potentially exposed.

According to Coinone’s Sunday notice, an external attacker gained unauthorized access to servers operated by MetaM, the company responsible for handling customer consultations, at approximately 4 a.m. local time on November 12. Coinone learned about the intrusion at around 9:20 a.m. that day after receiving a report from the contractor.

The exchange said the breach involved information customers had provided during telephone or online consultations. Customers who never contacted its support center were not affected, while the number of people whose information was exposed remains undisclosed.

Coinone data breach puts sensitive customer information at risk

The potentially compromised information includes names, telephone numbers, email addresses, dates of birth and bank account numbers. Passwords, South Korean resident registration numbers, identity document issuance dates, residential addresses, cryptocurrency wallet addresses and transaction IDs were also listed.

Coinone explained that the actual information exposed could vary depending on what each customer shared during previous consultations. The company has not established that every listed category was accessed for every affected individual.

The exchange plans to contact customers separately or introduce a dedicated service allowing them to check which personal details were involved. Investigators are still determining the full extent of the intrusion and the information taken from MetaM’s systems.

In a separate November 14 disclosure, MetaM said it detected suspicious activity after a customer-service outage at 6:03 a.m. on November 12, according to Yonhap. The company subsequently found evidence that telephone numbers and consultation conversations had been accessed without authorization or removed from affected systems.

MetaM reported the incident to the Korea Internet & Security Agency on November 13. It isolated compromised or potentially affected servers, blocked suspicious IP addresses and brought in cybersecurity specialists to investigate the attack.

Coinone says trading and wallet systems were not compromised

Despite the customer information exposure, Coinone maintained that its core cryptocurrency infrastructure remained separate from MetaM’s customer support servers.

The exchange said it had found “no evidence of a direct intrusion” into its account, trading or cryptocurrency wallet systems as of its November 15 disclosure. It continues to investigate the attack with the contractor and external security specialists.

Coinone explained that account access requires two-factor authentication through a registered OTP or KakaoTalk verification on a phone registered to the customer. It said the information identified so far would not, by itself, allow attackers to access accounts or withdraw cryptocurrency.

After learning of the breach, the company blocked the attacker’s IP address and unauthorized access routes. It transferred outsourced customer support operations to email consultations and strengthened monitoring for suspicious logins and transactions.

Coinone reported the incident to the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service. The exchange is reviewing MetaM’s security arrangements and investigating the circumstances surrounding the unauthorized access.

The exchange did not respond to a request for additional comment from crypto.news by press time.

Coinone warns customers about phishing and identity theft

Coinone warned that attackers could use information obtained during customer consultations to impersonate exchange employees. Potential risks include fraudulent telephone calls, phishing emails, spam messages and identity theft.

Customers who disclosed their passwords during support conversations were advised to change their Coinone credentials immediately. The exchange recommended updating passwords on other websites if customers had reused the same credentials.

It stressed that employees would never request passwords, OTP numbers or verification codes through telephone calls, emails or text messages. Customers were also warned against responding to requests to transfer cryptocurrency or change their registered withdrawal addresses.

Coinone advised users to review their account activity and report unauthorized login attempts, orders or withdrawals. Customers can change passwords, lock their accounts and review registered withdrawal addresses through the exchange’s website or mobile application.

The company’s notice outlines possible compensation procedures under South Korean law. Depending on the circumstances, affected customers may pursue damages, including statutory claims of up to 3 million won when proving their actual losses is difficult.

South Korea strengthens crypto exchange cybersecurity rules

The Coinone breach follows several cybersecurity incidents involving South Korean financial institutions. Bithumb previously reported an employee data breach while investigating whether customer information had been accessed.

In October, the Financial Services Commission identified cybersecurity weaknesses at 130 of 555 financial institutions reviewed. Authorities proposed stronger security monitoring and more frequent vulnerability assessments following attacks affecting financial and cryptocurrency businesses.

On November 12, South Korea announced additional exchange protections, including plans to permit temporary withdrawal restrictions when operators suspect hacking. The measures include round-the-clock transaction monitoring and additional security inspections.