Coinone customer data leaked after support-firm hack
The disclosure
Coinone issued a public notice on November 15 confirming the incident and apologising to affected customers. Reporting by Chosun Biz, Herald Business and SBS News on the same day placed the disclosure in the public record within hours of the exchange's confirmation, which Coinone timed at approximately 08:00 Korea Standard Time. The exchange said it had reported the incident to the Korea Internet and Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service, the three authorities that oversee data protection and financial supervision in South Korea.
Timeline of the intrusion
According to Coinone, the intrusion into MetaM's servers occurred at approximately 04:00 Korea Standard Time on November 12, 2026. The exchange said it became aware of the incident at approximately 09:20 the same morning, roughly five hours after the intrusion began. Three days elapsed between detection and public confirmation, during which Coinone said it investigated the scope of the exposure, blocked the attack, and prepared its notification to customers and regulators. The sequence of events, as reported by Chosun Biz and Herald Business, indicates that the exchange's first public statement followed its internal assessment rather than preceding it.
What data may have been exposed
The data potentially exposed varies by customer and is limited to customers who have a history of contact with Coinone's support service. The categories identified in the disclosure include names, phone numbers, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers, identity-card issue dates, home addresses, wallet addresses and transaction identifiers. The exposure of resident registration numbers is of particular significance in South Korea, where the number serves as a primary personal identifier across government, financial and commercial services. Coinone has not stated that every listed category was exposed for every affected customer, and it has not published a count of affected customers.
What was not breached
Coinone has stated that its own member-account, trading and wallet systems were not directly breached. The exchange reported no signs of unauthorised access to those systems to date. The distinction matters because the intrusion targeted a contractor's support infrastructure rather than the exchange's core trading platform, and no evidence has been presented that customer funds or trading accounts were accessed through the exchange's own systems. The statement is qualified rather than absolute: the investigation is ongoing, and Coinone has not issued a final determination that no further exposure occurred.
Regulatory notification
The incident has been reported to the Korea Internet and Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service. Under South Korean law, a personal-data breach of this kind triggers notification duties to both the regulator and the affected individuals, and the Financial Supervisory Service may examine whether the exchange's outsourcing arrangements met the security standards required of a registered virtual-asset service provider. Coinone said it is cooperating with the authorities and with the police investigation into the attack.
Guidance for affected customers
Coinone has warned customers of an elevated risk of voice phishing and identity theft, and it has urged particular caution around unsolicited contact claiming to represent the exchange. Customers who shared a password with the support centre during a support interaction have been advised to change their Coinone password and to change the same password on any other service where it was reused. The exchange has switched its customer-support operations to email only while the incident is addressed, and it has blocked the attacker's internet addresses and access to the customer centre. Coinone has also said it plans to provide a lookup service so that individual customers can check which of their data was affected.
Why the incident matters
The breach illustrates a recurring weakness in the security of cryptocurrency exchanges: the outsourcing of customer-facing functions to third-party firms. Support operations necessarily hold sensitive personal data, including identity documents and account credentials collected during verification, yet they often sit outside the security perimeter of the exchange itself. An attacker who compromises a contractor gains access to the same data that a direct breach of the exchange would yield, without needing to defeat the exchange's own defences. The incident also follows a separate data leak at TSMC reported on November 12, which involved employee data and a different attack vector; the two incidents are unrelated, and they should not be conflated.
What happens next
Three questions will determine the significance of the incident in the coming weeks. The first is the scale of the exposure: how many customers are affected and which data categories were taken for each of them. The second is whether the exposed data is used in phishing or identity-theft campaigns, which Coinone's warning suggests is a realistic prospect. The third is the regulatory outcome: whether the Personal Information Protection Commission or the Financial Supervisory Service finds that Coinone or MetaM failed to meet the required security standards for outsourced processing of personal data. The lookup service Coinone has promised will provide the first concrete answer to the scale of the exposure, and its accuracy will be a test of the exchange's handling of the incident.
Source: Chosun Biz, SBS News and Herald Business, November 15, 2026.
