Coinone warns of phishing, identity theft after data breach - Cryptonews.net

The intrusion occurred on Thursday, November 12, 2026, at approximately 4 a.m. local time, though Coinone only disclosed the breach publicly three days later on Sunday. The attacker accessed customer support records stored on MetaM's servers, which contained a wide range of sensitive user information.

The potentially exposed data includes names, phone numbers, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers, home addresses, crypto wallet addresses, and transaction IDs. Only users who had interacted with customer support were affected.

Exchange Response

Coinone has temporarily switched its customer support to email only while dealing with the fallout. The company reported the incident to multiple Korean regulators, including the Korea Internet & Security Agency (KISA) and the Financial Supervisory Service.

Industry Vulnerability

The incident highlights a common industry vulnerability: exchanges often outsource customer support to separate companies, which may have different security practices. While Coinone's wallets remained untouched, the contractor's records contained enough information to pose significant risks to customers.

For affected users, the primary concern is social engineering rather than direct account theft. Scammers could use the leaked information to impersonate Coinone, banks, or government agencies with high accuracy. Customers are advised to change passwords, especially if reused across other services.

What's Next

Regulators are now investigating the breach, and customers should watch for any phishing campaigns tied to the leaked records. The market will be monitoring whether Coinone publishes a count of affected users and what conclusions regulators reach about the security failures.