Coinone data breach raises phishing and identity-theft risks

The Coinone data breach has raised concerns that customer-support records could be used for phishing, impersonation or identity theft. South Korea’s crypto exchange said an attacker accessed servers at an outsourced support provider. As of November 15, 2026, Coinone had not disclosed how many customers may be affected.

Coinone said its trading and wallet systems are separate from the contractor’s servers and that it had found no evidence they were directly breached. That does not rule out scams using personal details to make fraudulent messages seem credible.

What we know about the Coinone data breach

How the Coinone data breach was discovered

According to Coinone’s official notice, an outside attacker accessed servers used by MetaM, its outsourced customer-support provider, at about 4:00 a.m. on November 12. MetaM notified Coinone at about 9:20 a.m. Coinone said the attacker viewed, or may have taken, customer-support records. It has not described how access was gained or confirmed that records were removed.

The information potentially involved includes names, phone numbers, email addresses, birth dates, bank-account numbers, passwords, Korean resident-registration numbers, identification-card issue dates, home addresses, crypto wallet addresses and transaction IDs. Coinone said the details at issue may differ by customer. The list does not mean every field was exposed for every account.

Coinone said its member-account, trading and crypto-wallet systems are separate from MetaM’s servers, with no evidence so far of a direct breach of those systems. It blocked the attacker’s IP address and access paths, increased monitoring for unusual logins and transactions, and moved outsourced customer support to email.

The exchange said it reported the incident to KISA, the Personal Information Protection Commission and the Financial Supervisory Service. It is investigating with MetaM and specialist organizations, reviewing the contractor’s security management, and said it planned a service for customers to check what information was affected. Coinone apologized and said it felt a deep responsibility for the incident.

What is still unclear

The scale remains unknown. Coinone had not disclosed the number of affected customers in Cointelegraph’s November 15 reporting, which also covered the exchange’s warning about phishing and identity theft. Coinone said it planned a service for customers to check which information was affected.

It is also unclear which records were accessed, whether information was definitively taken, how long the attacker had access, or what vulnerability or access path was used. Coinone said it was investigating the cause. Available information does not establish whether the incident extended beyond MetaM’s environment.

These gaps matter because personal details can make fraudulent messages more convincing. Coinone warned that information could be used for impersonation, voice phishing, phishing emails, spam texts or identity theft. It advised customers who shared passwords in support conversations to change them, including on other services where they reused those passwords.

Market data and broader sentiment

The supplied market snapshot cannot establish whether the Coinone data breach affected prices. Bitcoin and Ethereum were down over the previous 24 hours and week, but that timing does not establish a connection to the incident. The supplied reporting included no analyst comments linking the breach to market prices.

CoinGecko recorded these prices and changes at 10:13 UTC on November 15, 2026:

The Crypto Fear & Greed Index stood at 10, or “Extreme Fear,” on November 15, according to Alternative.me. That reflects broader market sentiment, not a measured response to Coinone’s disclosure. The evidence available here includes no Coinone-specific token or share-price data.

South Korea’s Financial Services Commission said on October 14 that a checklist review of 555 financial companies found deficiencies at 130, which were being addressed. The FSC described this as a sector-wide review, not a finding about Coinone or this breach.

What the Coinone data breach means for investors

For customers, the concern is that exposed information could be used for deception, not a confirmed breach of trading or wallet infrastructure. Coinone warned that the information could be used for impersonation, voice phishing, phishing emails, spam texts or identity theft.

Coinone advised customers who shared passwords in support conversations to change them, including on other services where they reused those passwords. It has not said that all customer passwords were exposed, so the extent of that risk remains uncertain.

Coinone said crypto-wallet addresses and transaction IDs may have been involved, but it had found no evidence that its member-account, trading or crypto-wallet systems were directly breached. The company warned that exposed information could be used for phishing or impersonation.

The incident also raises questions about outsourced service providers. Coinone said it was reviewing MetaM’s security management. Separately, the FSC said its October checklist review found deficiencies at 130 of 555 financial companies, which were being addressed; it described this as a sector-wide review, not a finding about Coinone’s breach.

Bottom line

Coinone says an attacker accessed its support contractor’s servers, potentially involving a wide range of personal and account-related details. The number of affected customers, exact records accessed and method of entry remain unknown as Coinone investigates and prepares a customer lookup service.

Sources

• Coinone warns of phishing, identity theft after customer data breach (Cointelegraph)
• 개인정보 유출 사실 관련 안내 (coinone.co.kr)
• Coinone warns of phishing, identity theft after customer data breach (cointelegraph.com)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.