South Korea’s Coinone data breach may expose passwords, IDs, wallet addresses - Crypto News

Coinone disclosed a security incident on November 15 involving its outsourced customer support provider, MetaM. The exchange stated that an external attacker gained unauthorized access to MetaM's servers at approximately 4 a.m. local time on November 12.

Coinone learned about the intrusion at around 9:20 a.m. that day after receiving a report from the contractor. The company has not yet disclosed the number of affected customers, noting that the breach only impacts those who had previously contacted the support center.

The potentially exposed information includes names, telephone numbers, email addresses, dates of birth and bank account numbers. Passwords, South Korean resident registration numbers, identity document issuance dates, residential addresses, cryptocurrency wallet addresses and transaction IDs were also listed.

Coinone explained that the actual information exposed could vary depending on what each customer shared during previous consultations. The company has not established that every listed category was accessed for every affected individual.

Investigation and response

In a separate disclosure on November 14, MetaM said it detected suspicious activity after a customer-service outage at 6:03 a.m. on November 12. The company subsequently found evidence that telephone numbers and consultation conversations had been accessed without authorization or removed from affected systems.

MetaM reported the incident to the Korea Internet & Security Agency on November 13. The company isolated compromised or potentially affected servers, blocked suspicious IP addresses and brought in cybersecurity specialists to investigate the attack.

Despite the customer information exposure, Coinone maintained that its core cryptocurrency infrastructure remained separate from MetaM's customer support servers. The exchange said it had found 'no evidence of a direct intrusion' into its account, trading or cryptocurrency wallet systems as of its November 15 disclosure.

Coinone explained that account access requires two-factor authentication through a registered OTP or KakaoTalk verification on a phone registered to the customer. It said the information identified so far would not, by itself, allow attackers to access accounts or withdraw cryptocurrency.

After learning of the breach, the company blocked the attacker's IP address and unauthorized access routes. It transferred outsourced customer support operations to email consultations and strengthened monitoring for suspicious logins and transactions.

Coinone reported the incident to the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service. The exchange is reviewing MetaM's security arrangements and investigating the circumstances surrounding the unauthorized access.

Customer warnings and legal implications

Coinone warned that attackers could use information obtained during customer consultations to impersonate exchange employees. Potential risks include fraudulent telephone calls, phishing emails, spam messages and identity theft.

Customers who disclosed their passwords during support conversations were advised to change their Coinone credentials immediately. The exchange recommended updating passwords on other websites if customers had reused the same credentials.

It stressed that employees would never request passwords, OTP numbers or verification codes through telephone calls, emails or text messages. Customers were also warned against responding to requests to transfer cryptocurrency or change their registered withdrawal addresses.

Coinone advised users to review their account activity and report unauthorized login attempts, orders or withdrawals. Customers can change passwords, lock their accounts and review registered withdrawal addresses through the exchange's website or mobile application.

The company's notice outlines possible compensation procedures under South Korean law. Depending on the circumstances, affected customers may pursue damages, including statutory claims of up to 3 million won when proving their actual losses is difficult.

Broader regulatory context

The Coinone breach follows several cybersecurity incidents involving South Korean financial institutions. Bithumb previously reported an employee data breach while investigating whether customer information had been accessed.

In October, the Financial Services Commission identified cybersecurity weaknesses at 130 of 555 financial institutions reviewed. Authorities proposed stronger security monitoring and more frequent vulnerability assessments following attacks affecting financial and cryptocurrency businesses.

On November 12, South Korea announced additional exchange protections, including plans to permit temporary withdrawal restrictions when operators suspect hacking. The measures include round-the-clock transaction monitoring and additional security inspections.