South Korean exchange Coinone said on Sunday 15 November 2026 that an attacker broke into the servers of MetaM, the outside company that runs its customer support, and viewed or copied records of customer conversations. The Coinone data breach may include names, phone numbers, bank account numbers, passwords and national ID numbers, depending on what each person told support. Only customers who once contacted the help desk by chat or phone are affected, according to the notice Coinone posted on its website. The exchange has not said how many people that is.
Coinone says member accounts, trading and crypto wallets run apart from the vendor’s servers and that no direct intrusion into them has been confirmed. No loss of crypto has been reported. The risk Coinone itself points to is a different one: fraudsters who know what a customer once asked support, and use it to sound like the exchange.
The incident is the third data or security scare at a Korean exchange in less than three weeks, after Bithumb on 27 October and Gopax on 6 November, and it lands while regulators in Seoul are still reworking their rules after the Binance hack.
How the attack on Coinone’s support vendor unfolded
The attacker got into the vendor’s servers at about 04:00 on Thursday 12 November, Korean time (19:00 UTC on 11 November), according to the notice, which names the contractor as MetaM Co., Ltd. Coinone learned of it from MetaM at 09:20 the same morning. The notice went up at 08:00 on Sunday 15 November, three days later.
The exact timing and the method of the attack are still being investigated with the vendor and outside specialists, Coinone writes, and it promises updates.
What was exposed in the Coinone data breach, and what was not
The files held what customers typed or said during support sessions. The notice lists the items that may be in them:
- name, phone number, email address and date of birth;
- bank account number and password;
- resident registration number (Korea’s national ID number) and the issue date of the ID card;
- home address, crypto wallet address and transaction ID (TXID).
Not every customer gave all of these. The data differs from person to person, and Coinone says it will later let customers check what was held about them. A customer who asked a simple question about a deposit may have left a name and a TXID; one who needed help with identity checks may have left far more.
Passwords are the item that stands out. Support staff are not supposed to need them, yet the notice tells customers who shared a password in a consultation to change it. Whether the vendor kept passwords in its records or whether they appear only in chat logs is not stated.
What was not touched, according to Coinone: member accounts, the trading systems and the crypto wallets. It adds that every login needs a second factor, a registered OTP or a KakaoTalk confirmation on a phone in the customer’s name, that logins from unofficial apps are blocked, and that the leaked data alone cannot be used to log in or withdraw. That is the company’s assessment; no outside audit has been published.
What Coinone has done, and what it tells customers
The exchange says it blocked the attacker’s IP address and the access paths to its customer centre, stepped up real-time monitoring of unusual logins and transactions, and is reviewing MetaM’s security controls itself. Customer service now runs by email only.
It reported the breach to the Korea Internet & Security Agency (KISA), the Personal Information Protection Commission (PIPC) and the Financial Supervisory Service (FSS). It says it is cooperating with their inquiries.
Its advice to customers:
- If you gave your password to support, change it on Coinone and on every other site where you used the same one.
- The exchange never asks by phone, text or email for a password, an OTP or a verification code, and never asks a customer to make a withdrawal or change a wallet address, the notice says.
- Treat any call or message that mentions your earlier support history with suspicion, and do not open links or attachments from unknown senders.
- Report any login, order or withdrawal you do not recognise, and check the withdrawal address book in the app or on the website; you can also lock the account.
The second point matters most. A caller who knows your bank, your ID number and the date you asked about a stuck transfer sounds very much like the real exchange. Leaked data often turns into theft that way, with the thief talking the customer into acting rather than breaking into the platform. Our guide to spotting crypto scams and where to report them covers the usual scripts.
Compensation: up to 3 million won in statutory damages
Coinone has not announced a compensation programme. Instead, the notice sets out the remedies Korean law gives customers whose data leaks.
Under the Personal Information Protection Act (article 39) and the Credit Information Act (article 43), a customer can claim damages, and the company must prove it was not at fault. If the leak came from intent or gross negligence, a court can award up to five times the actual loss. When the loss is hard to put a figure on, a customer can instead claim statutory damages of up to 3 million won under article 39-2 of the first law and article 43-2 of the second, without proving the amount lost or the company’s fault.
The notice also lists three public contacts: the Personal Information Dispute Mediation Committee (1833-6972), the Personal Information Infringement Report Center run by KISA (118) and the FSS (1332). Damage reports go by email to Coinone’s service operations team.
Korea’s run of exchange incidents since late October
Coinone is Korea’s third-largest exchange by volume, a long way behind the top two. In the fourth quarter of 2025 it handled about $8.7 billion of trading, a 3.1% share of the five main Korean exchanges, against 65.0% for Upbit and 31.1% for Bithumb, according to CoinGecko figures reported by Digital Today.
Its notice follows a string of incidents. On 27 October Bithumb found an outsider in the mobile system its employees use for work and reported a personal data leak to KISA and the PIPC (details in the Bithumb employee-system breach). On 6 November Gopax halted trading and withdrawals after an email from a group claiming to have hacked it, with no loss reported; see Gopax’s withdrawal halt.
All of this came after the $6.3 billion theft from Binance on 29 October, which the FBI attributed to North Korea on 31 October (our report on the FBI’s attribution). The Financial Services Commission (FSC) held an emergency meeting with exchanges on 2 November, the Korea Times reported. One FSC official told the paper: “We will continue to strengthen our response framework in close cooperation with relevant agencies”.
A year earlier, on 27 November 2025, Upbit lost about $36 million in Solana-network assets from a hot wallet, according to Cointelegraph; its operator Dunamu covered the losses.
| Date | Exchange | What happened | Customer crypto lost |
|---|---|---|---|
| 27 Nov 2025 | Upbit | Hot-wallet hack, Solana-network assets | About $36M, covered by Dunamu |
| 27 Oct 2026 | Bithumb | Outsider in employee work system, data leak reported | None reported |
| 6 Nov 2026 | Gopax | Trading and withdrawals halted after a hacking-threat email | None reported |
| 12 Nov 2026 | Coinone | Support vendor MetaM breached, consultation records exposed | None reported |
Regulators’ next moves on withdrawals and vendors
The rules are moving at the same time. Under the Virtual Asset User Protection Act, Korean exchanges cannot block deposits or withdrawals at will, only on grounds set by presidential decree, and must keep 80% of customer assets in cold storage, according to the Korea Times. After the Binance hack, the industry asked for clearer grounds to pause when another platform is attacked.
On Thursday, the day of the Coinone intrusion, the regulator said it would let exchanges suspend withdrawals when a hack is suspected and called for round-the-clock monitoring, according to Cointelegraph, which also reports that the FSC found security weaknesses at 130 of the 555 financial firms it reviewed in October.
Coinone’s case points at a gap those measures do not cover. Withdrawal pauses protect coins; they do nothing for records held by a contractor. Here the weak point was a contractor, and checking how a company supervises the firms that handle its customers’ data falls to the PIPC.
What it means for readers outside Korea
Coinone serves Korean residents, and nothing public links this incident to Europe or the United States. Help-desk outsourcing is common everywhere, though. In the EU, MiCA-licensed providers must manage outsourcing risk, the DORA regulation has governed how they oversee ICT suppliers since January 2025, and a personal data breach must be notified under GDPR to the national authority, the CNIL in France or the Garante in Italy. Our explainer on how centralized exchanges handle KYC and custody sets out what data a platform holds.
Open questions and what to watch
Several facts are still missing. Coinone has not given the number of customers whose records were in MetaM’s files, or the dates those records cover. Nor is it known whether MetaM’s other clients, if any, are affected, or whether any customer has reported a fraudulent call or transfer since 12 November.
The next markers are the individual lookup Coinone has promised, the results of its investigation with outside specialists and any action by the PIPC or the FSS. Customer support, for now, stays on email.