Prabang Leaks Personal Data of 7 Members in Third Hack in a Month

Seven Members, Eight Data Categories Exposed

South Korean virtual asset exchange Prabang has disclosed that a security breach exposed the personal data of seven of its members, according to the company's official announcement published on Thursday, November 5. The intrusion stems from access by an unauthorized external party around October 24, and it reached into eight categories of member records: names, membership numbers, email addresses, mobile phone numbers, one-time password (OTP) key values, asset balances, personal wallet addresses and login passwords. The exchange stresses that the exact items taken vary from one member to another, since not every account carried the same data profile. Prabang says it will notify each affected member individually about the leak. The disclosure lands while the platform remains offline: the exchange suspended services after finding security vulnerabilities during a system inspection, and it has kept trading and member access shut ever since. The company also confirmed it has reported the incident to the relevant authorities under applicable law and is still working to establish the cause and the full scale of the compromise. For a market that has watched a string of platform failures this year, the detail that stands out is how deep the leak goes: OTP key values and login passwords together would let an attacker bypass the standard two-factor protections that most exchanges rely on, not merely harvest contact details for phishing. Prabang has not yet said whether the leaked credentials were hashed or stored in plaintext, a gap that leaves the real account-takeover risk unquantified until the ongoing investigation reports its findings.

A 100 Million Won Theft and a Month of Failures

The timeline points to a rolling failure rather than a single lapse. Prabang suffered its first data leak on October 2, then detected an abnormal withdrawal from its hot wallet on October 24, with roughly 100 million won in digital assets taken. The exchange says it activated an emergency response framework immediately after spotting the withdrawal and ran a full inspection of its systems, a process that surfaced the vulnerabilities behind the current shutdown. According to the company's notice, the personal data exposure confirmed this week is believed to have occurred at the same time as the October 24 hot wallet incident, and Prabang describes it as separate from the October 2 leak. On remediation, the exchange has committed to verifying the exact assets lost and covering the damage in full with its own capital. It adds that it is pursuing a broad security upgrade and system overhaul to prevent a repeat, while the joint investigation with authorities determines the root cause. The company has not disclosed how the attacker moved funds out of the hot wallet, which chain the assets left on, or whether any portion has been frozen or recovered, so the recovery picture stays open until those details are published.

From COINOTAG's desk, the leaked combination matters more than the headline number: 100 million won is a modest theft, but OTP key values and login passwords in the same dump turn a privacy incident into a live credential risk for every affected account. Members of the breached platform should rotate credentials, revoke active sessions and move holdings to self-custody with a hardware wallet while the service is down, since leaked wallet addresses and balance data make targeted phishing straightforward. The broader read is that a three-breach month from a small exchange, followed by an open-ended shutdown, is exactly the scenario the DYOR principle exists for; platform risk, not just market risk, belongs in every allocation decision, and our best crypto exchanges framework weights incident history accordingly.