Coinone says an attacker accessed customer support records at contractor MetaM. The exchange has found no signs of a direct intrusion into its separate account, trading or wallet systems.
South Korean crypto exchange Coinone disclosed a customer data breach on November 15 after an attacker accessed servers at MetaM, its customer support contractor. The exposed records contain information customers supplied during phone or online support conversations.
According to the company’s account of the incident, the intrusion occurred on November 12 and MetaM notified Coinone that day. Investigators are still establishing exactly when information was leaked and how the attacker gained access. Coinone says it has found no signs of a direct intrusion into its account, trading or crypto wallet systems, which run separately from the contractor’s servers.
Data shared during support conversations exposed
The disclosure lists 11 types of information that may have been exposed. It does not say that all 11 were taken from every customer. What was exposed depends on what each person shared with support.
| Category | Fields disclosed |
|---|---|
| Identity and contact details | Name, phone number, email, date of birth, Korean resident registration number, ID issuance date and home address |
| Account information | Bank account number and any password shared during a conversation |
| Crypto transactions | Wallet address and transaction ID (TXID) |
Newsway reports that users who had never contacted customer support were not affected by this incident. The number of affected customers has not been disclosed. Coinone plans individual notifications or a lookup service showing which information was exposed; it has not announced that the service is available.
A wallet address and a transaction ID identify different things: a sending or receiving address, and a particular transaction. Neither grants spending authority on its own. However, matching public blockchain activity to a person’s name can make their financial activity easier to trace.
Coinone switches support to email
The exchange says it blocked the internet addresses used in the attack and access routes to the support server. It moved outsourced support to email and strengthened monitoring for unusual logins and transactions.
Coinone reported the incident to the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service. It is investigating the cause with MetaM and specialist organisations, while inspecting the contractor’s security controls. Coinone has not announced a compensation plan or payment date.
Scammers may refer to earlier conversations
Coinone asked customers who gave support their passwords to change them, including on other websites where the same passwords were used. The exchange says it does not ask for passwords, one-time passwords or verification codes by phone, text or email, or tell customers through those channels to withdraw crypto or change a wallet address.
Knowing the details of an earlier conversation does not prove that a caller works for support. Someone using the leaked records could direct a customer to a new phishing link. Coinone also asks customers to report login, order or withdrawal attempts they did not make.
The UK National Cyber Security Centre’s general data breach guidance explains that criminals can exploit publicity around a breach to contact people whose information was not exposed. It recommends reaching an organisation through a known official channel, rather than links or contact details in an incoming message. The guidance is not an investigation into the Coinone incident.
