Coinone Data Breach: Vendor Hack Exposes 11 Customer Data Fields

11 Fields, Passwords Among Them

Coinone confirmed on November 15 that customer information handled by an external contractor was exposed after hackers broke into that contractor's servers. The South Korean exchange said unauthorized outsiders accessed the systems of Metam, the firm that runs its outsourced customer support desk, and that the personal data collected during consultations was the target. The intrusion began at around 4:00 AM on November 12, and Metam reported the incident to Coinone at 9:20 AM the same morning.

The company published a list of 11 data categories that may have leaked: phone number, name, email address, date of birth, bank account number, password, resident registration number, the issuance date of identity documents, home address, virtual asset wallet address, and the transaction identifier known as TXID, the string that pinpoints an individual transfer on a blockchain. The list aggregates the types of information customers handed over during chat and phone consultations. It does not mean every user lost every field, and the items actually exposed vary from one account to the next. Customers with no support history are not part of the incident.

Coinone said it is preparing a lookup service, together with individual notices, so each user can check which of their details were involved. It also stressed that member accounts, the trading engine and the wallet infrastructure run separately from the vendor's consultation servers, and that as of the notice's publication it had found no trace of direct intrusion into those systems.

Regulator Reports and a Password Warning

After becoming aware of the breach, Coinone blocked the internet addresses and unauthorized access routes used in the attack and moved its customer center to email-only consultation. The company filed reports with the Korea Internet and Security Agency (KISA), the Personal Information Protection Commission and the Financial Supervisory Service, and is working with Metam and outside specialists to establish how the intrusion happened and how far the damage reaches. It has also tightened real-time monitoring for unusual logins and transactions, and said it will review the contractor's security management directly, along with the safeguards in place across its partner network.

The exchange warned that the leaked details could feed voice phishing, phishing emails, spam texts and identity fraud. Anyone who gave a password during a consultation was told to change it immediately, and to update the same credentials on any other service where they were reused. Coinone reminded customers that it never asks for one-time passwords, authentication codes or withdrawals, and that messages citing prior consultations may be impersonations. Users can lock their accounts and review registered withdrawal addresses in the app or on the web, and the company asked them to report any logins, orders or withdrawals they did not initiate.

The notice also states that customers harmed by the leak can seek compensation, including statutory damages, under Korean law. It draws a line between two separate questions: exposure of passwords shared during support sessions, and whether the exchange's own account system was breached, which remains unconfirmed. The episode follows a similar probe at Bithumb, where hackers compromised an employee-facing internal system and the exchange examined whether customer data had escaped; the Coinone incident differs because the hit landed at a support contractor rather than on the trading platform itself.

The breach shows where the real attack surface sits for a centralized exchange: outsourced human operations. No funds moved, and the segregated design of the trading and wallet systems appears to have held, which is why this incident is a data compromise rather than a theft. The risk is indirect. Wallet addresses and TXIDs are pseudonymous on a public ledger, and a DEX works the same way; paired with names, resident registration numbers and phone numbers, they give fraudsters credible material for targeted phishing. The outsourcing model is not unique to crypto, since banks across TradFi run call centers the same way. Vendor audits, not just cold storage, are becoming the differentiator among the best crypto exchanges, and Coinone's next report on the confirmed scope of the leak is the item to watch.