Coinone data breach exposes customer records via support contractor

What happened

Coinone, a South Korean cryptocurrency exchange, said on Nov. 15, 2026, that an external attacker had gained unauthorized access to servers operated by MetaM, the outsourced provider that handles its telephone and online customer consultations. According to the exchange, the intrusion occurred around 4 a.m. Korea Standard Time on Nov. 12. MetaM notified Coinone at about 9:20 a.m. that day, and Coinone published its disclosure on Nov. 15. Bitcoin.com News and Crypto.news both reported the disclosure.

The records potentially involved cover 11 categories: telephone numbers, names, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers, identification document issuance dates, residential addresses, cryptocurrency wallet addresses and transaction identifiers. Coinone said the exposed information could vary by customer and concerned details voluntarily supplied during earlier support interactions. Customers who never contacted the support center fall outside the identified scope. The exchange has not said how many people were affected or exactly what data was taken, and it plans a lookup service for customers to check which details were involved.

Coinone said its customer accounts, transaction systems and cryptocurrency wallets operate independently of MetaM's servers. As of its Nov. 15 notice, it had found no evidence of a direct intrusion into those core systems. The exchange argued that the partial information identified so far would not by itself let a third party log in or withdraw assets, because access requires additional verification through a registered one-time password or KakaoTalk on a phone registered to the customer. Coinone said it blocked suspicious IP addresses, restricted access to compromised systems, increased monitoring of transactions and moved outsourced support temporarily to email-only service. It notified the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service, and is investigating with MetaM and outside security specialists.

MetaM issued a separate disclosure on Nov. 14, according to Yonhap. It said it detected suspicious activity after a customer-service outage at 6:03 a.m. on Nov. 12, and later found evidence that telephone numbers and consultation conversations had been accessed without authorization or removed from affected systems. MetaM reported the matter to the Korea Internet & Security Agency on Nov. 13, isolated compromised or potentially affected servers, blocked suspicious IP addresses and brought in cybersecurity specialists.

Why it matters

The exposed categories include credentials and identifiers that can support phishing, impersonation and identity theft even if cryptocurrency holdings remain untouched. Coinone warned that calls or messages referring to past support conversations may be impersonation attempts. It advised customers who had disclosed passwords during support interactions to change their Coinone credentials immediately and to update the same passwords elsewhere if they had been reused. The exchange also said its employees would never request passwords, one-time password codes or verification codes by telephone, email or text message, and it warned against requests to transfer cryptocurrency or alter registered withdrawal addresses.

Under South Korean privacy legislation, affected customers may seek statutory damages of up to 3 million won when proving actual financial losses is difficult, according to the reports. MetaM's role highlights a broader operational risk for exchanges: customer data held by outside service providers can be exposed even when trading and custody infrastructure remains separate.

Background

Coinone is South Korea's third-largest cryptocurrency exchange by trading activity, behind Bithumb and market leader Upbit. OKX holds a 20% stake, while the remaining ownership is divided among founder and CEO Cha Myung-hoon, Com2uS Holdings and Korea Investment & Securities. The incident follows other 2026 breaches involving customer information at crypto businesses. On Nov. 3, Gnosis Pay reported unauthorized access involving its legacy cryptocurrency debit card infrastructure, potentially exposing payment card details and wallet addresses. In October, Bithumb found unauthorized access to internal communications infrastructure, with records associated with 6,444 customers and directly exposed personal information for 844 individuals. Coinbase disclosed customer information exposure linked to a September incident involving third-party analytics provider Amplitude, while saying its own infrastructure and customer funds were unaffected. Separately, South Korea announced additional exchange protections on Nov. 12, including plans to allow temporary withdrawal restrictions when operators suspect hacking.

What to watch

Several questions remain unresolved: the number of affected Coinone customers, the precise data extracted from MetaM's systems and whether the exposed information leads to fraud. Investigators are still determining the full extent of the intrusion. Coinone said customers can use its website or mobile app to change passwords, lock accounts and review registered withdrawal addresses, and it advised users to review account activity and report unauthorized login attempts, orders or withdrawals. Crypto.news said Coinone did not respond to a request for additional comment by press time.

Questions readers ask